SB2026080106 - Multiple vulnerabilities in Wasmtime

Description

This security bulletin contains information about 2 vulnerabilities.

1) Out-of-bounds write (CVE-ID: N/A)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption, trigger a panic, or disclose limited information.

The vulnerability exists due to out-of-bounds write and type confusion in Wasmtime store APIs when mixing objects from one Engine into a Store associated with a different Engine. A local privileged user can pass mismatched Engine objects to affected APIs to cause memory corruption, trigger a panic, or disclose limited information.

This issue is not triggerable by guest WebAssembly programs and requires the embedder to create multiple Engine instances and mix objects between them. User interaction is required.

2) Improper control of a resource through its lifetime (CVE-ID: N/A)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause memory corruption or a denial of service.

The vulnerability exists due to stale pointer handling in bulk-data-transfer operations when preemption occurs and the store state is mutated or execution is resumed after cancellation. A remote privileged user can trigger preemption during a bulk operation and alter store state to cause memory corruption or a denial of service.

Exploitation requires embedding patterns such as using epoch deadline callbacks to mutate store state or continuing to execute wasm within the same store after a timeout or trap.

Remediation

Install update from vendor's website.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q