Bbytecodealliance

Products

Exploited and recent CVEs

• CVE-2026-54912 High 8.8 WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatch 0.5%
• CVE-2026-54913 Medium 6.9 WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest 0.3%
• CVE-2026-54914 High 8.3 WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Buffer 0.4%
• CVE-2026-121441 Low 3.7 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling 0.2%
• CVE-2026-121440 Low 3.7 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass 0.2%
• CVE-2026-121439 Medium 5.3 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http 0.2%
• CVE-2026-119143 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 0.2%
• CVE-2026-119142 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop 0.3%
• CVE-2026-119141 Medium 5.3 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc 0.4%
• CVE-2026-119140 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield 0.2%
• CVE-2026-119139 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call 0.2%
• CVE-2026-119138 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap 0.3%
• CVE-2026-119137 Medium 5.3 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry 0.4%
• CVE-2026-119136 Medium 4.8 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass 0.2%
• CVE-2026-119135 Medium 4.8 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch 0.2%
• CVE-2026-119134 Medium 6.2 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles 0.2%
• CVE-2026-119133 Low 2.6 Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags 0.2%
• CVE-2026-119132 Medium 4.8 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter 0.2%
• CVE-2026-119131 Medium 5.3 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http 0.3%
• CVE-2026-119130 Low 2.6 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling 0.2%
• CVE-2026-118688 High 7.9 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename 0.2%
• CVE-2026-115893 Critical 9.9 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 1.0%
• CVE-2026-115892 Medium 5.7 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type 0.4%
• CVE-2026-115889 Critical 9.9 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 0.5%
• CVE-2026-115393 Low 3.8 Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion <0.1%
• CVE-2026-115392 High 7.9 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes 0.2%
• CVE-2026-115391 Medium 5.8 Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams 0.2%
• CVE-2026-115390 Medium 5.7 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS 0.2%
• CVE-2026-115389 Low 2.3 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API 0.2%
• CVE-2026-115388 Medium 6.2 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Write 0.1%