Wasmtime
44 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Wasmtime, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Wasmtime CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 2 |
| 2024-11 | 1 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 2 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 3 |
| 2026-03 | 0 |
| 2026-04 | 12 |
| 2026-05 | 1 |
| 2026-06 | 1 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 44 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High12
- Medium19
- Low10
Latest CVEs
The 15 most recently published vulnerabilities affecting Wasmtime.
- CVE-2026-58494Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination6.5
- CVE-2026-54786Wasmtime: Leak in WASIp1 `fd_renumber` implementation5.0
- CVE-2026-47261Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction7.5
- CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address space7.5
- CVE-2026-35195Wasmtime has an out-of-bounds write or crash when transcoding component model strings5.4
- CVE-2026-35186Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend7.5
- CVE-2026-34988Wasmtime leaks data between pooling allocator instances6.3
- CVE-2026-34987Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access9.9
- CVE-2026-34983Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`5.0
- CVE-2026-34971Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift7.8
- CVE-2026-34946Wasmtime's host panics when Winch compiler executes `table.fill`7.5
- CVE-2026-34945Wasmtime leaks host data with 64-bit tables and Winch6.5
- CVE-2026-34944Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-645.7
- CVE-2026-34943Wasmtime panics when lifting `flags` component value7.5
- CVE-2026-34942Wasmtime panics when transcoding misaligned utf-16 strings6.5
Product grouping is registry-driven, with AI assist and human review. How it works