Out-of-bounds write in Wasmtime - #VU140663
Published: August 1, 2026
Vulnerability identifier: #VU140663
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause memory corruption, trigger a panic, or disclose limited information.
The vulnerability exists due to out-of-bounds write and type confusion in Wasmtime store APIs when mixing objects from one Engine into a Store associated with a different Engine. A local privileged user can pass mismatched Engine objects to affected APIs to cause memory corruption, trigger a panic, or disclose limited information.
This issue is not triggerable by guest WebAssembly programs and requires the embedder to create multiple Engine instances and mix objects between them. User interaction is required.
Affected software
Wasmtime
Remediation
Install security update from vendor's website.
Wasmtime - addressed in versions 25.0.0, 37.0.0, 46.0.2, 47.0.3