← Vulnerability feed

Vulnerability record · CVE-2022-39393 · published 10 November 2022

CVE-2022-39393: Bytecodealliance wasmtime vulnerability

Bytecodealliance · Wasmtime

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.

8.6 CVSS 3.1 High EPSS 0.71% · top 48.2% CWE-226 · CWE-226CWE-212 · CWE-212
8.6CVSS 3.1 base score
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance allocator where when a linear memory is reused for another instance the initial heap snapshot of the prior instance can be visible, erroneously to the next instance. This bug has been patched and users should upgrade to Wasmtime 2.0.2 and 1.0.2. Other mitigations include disabling the pooling allocator and disabling the `memory-init-cow`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0 PatchThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf Third Party Advisory
https://github.com/bytecodealliance/wasmtime/commit/2614f2e9d2d36805ead8a8da0fa0c6e0d9e428a0 PatchThird Party Advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wh6w-3828-g9qf Third Party Advisory

Track CVE-2022-39393 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2023-26489Bytecodealliance cranelift-codegen out-of-bounds read vulnerabilitywasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where a…EPSS 1.3%9.8CVE-2022-39394Bytecodealliance wasmtime out-of-bounds write vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of t…EPSS 0.34%9.8CVE-2022-24791Bytecodealliance wasmtime use after free vulnerabilityWasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wa…EPSS 1.2%9.0CVE-2026-34987Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler back…EPSS 0.49%9.0CVE-2026-34971Bytecodealliance wasmtime out-of-bounds read vulnerabilityWasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on a…EPSS 0.39%8.8CVE-2023-30624Bytecodealliance wasmtime vulnerabilityWasmtime is a standalone runtime for WebAssembly. Prior to versions 6.0.2, 7.0.1, and 8.0.1, Wasmtime's implementation of managing per-instance state…EPSS 0.45%8.8CVE-2022-31146Bytecodealliance cranelift-codegen use after free vulnerabilityWasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types m…EPSS 1.2%8.1CVE-2022-23636Bytecodealliance wasmtime vulnerabilityWasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in the pooling instance allocator …EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2022-39393), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.