Bytecode Alliance wasmtime

Wasmtime doesn't fully sandbox all the Windows device filenames

Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Use after free in Wasmtime

wasmtime_trap_code C API function has out of bounds write vulnerability

Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Use After Free in Wasmtime

Wasmtime has Undefined Behavior in Rust runtime functions

Wasmtime vulnerable to data leakage between instances in the pooling allocator

Invalid drop of partially-initialized instances in wasmtime

Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Cranelift vulnerable to miscompilation of constant values in division on AArch64

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Wasmtime's host panics when Winch compiler executes `table.fill`

Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Wasmtime panics when lifting `flags` component value

Wasmtime: Panic when allocating a table exceeding the size of the host's address space

Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

Wasmtime vulnerable to out of bounds read/write with zero-memory-pages configuration

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

Wasmtime panics when transcoding misaligned utf-16 strings

Wasmtime leaks host data with 64-bit tables and Winch

Wrong type for `Linker`-define functions when used across two `Engine`s

Use after free passing `externref`s to Wasm in Wasmtime

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Wasmtime leaks data between pooling allocator instances

Wasmtime has an out-of-bounds write or crash when transcoding component model strings

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime vulnerable to panic when using a dropped extenref-typed element segment

Wasmtime runtime crash when combining tail calls with trapping imports

Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`

wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.

Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime has memory leak in C API with `externref` and `anyref` types

Wasmtime vulnerable to segfault when using component resources