Free of Memory not on the Heap in Wasmtime - CVE-2021-39218
Published: September 17, 2021 / Updated: April 23, 2026
Vulnerability identifier: #VU127031
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-39218
CWE-ID: CWE-590
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Wasmtime
Wasmtime
Software vendor:
Bytecode Alliance
Bytecode Alliance
Description
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to incorrect GC stack map handling in Wasmtime externref and GC safepoint handling when running Wasm that uses externrefs during garbage collection. A remote attacker can execute crafted Wasm that uses externrefs to cause memory corruption.
Exploitation requires the host to create non-null externrefs and a garbage collection to occur while a Wasm frame is at a GC safepoint with no live references after an earlier safepoint in the same function had live references.
Remediation
Install security update from vendor's website.