CVE-2021-38297

CVE-2021-38297 の悪用: GO Wasm バッファオーバーフローの脆弱性 脆弱性の概要 WebAssembly WASM は、最新の Web ブラウザの大部分で実行可能なバイナリ命令フォーマットです。C、C++、Rust、GO などのさまざまな高水準言語のコンパイルターゲットとして機能し、これらの言語で記述されたコードを WASM にコンパイルできます。 CVE-2021-38297 は、GO による GO コンパイル済み WASM バイナリのコンパイルとロードにおける重大なバグを浮き彫りにしています。この脆弱性は、GO が提供する JS wasm ローダー...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – 通过表索引混淆导致的 WebAssembly 线性内存越界访问 概述 WebAssembly 模块使用了一个导入函数，该函数对数组索引没有边界检查。攻击者可以提供越界索引，在线性内存之外进行读取或写入，从而可能泄露宿主机密或在 WASM 运行时中实现代码执行。 漏洞详情 类型： 越界访问（WASM） 影响： 宿主机内存破坏，在某些运行时中可导致 RCE。 根本原因： Rust unsafe 代码在偏移原始指针时未将索引限制在数组长度范围内。 漏洞利用演示 1. 将 Rust 代码编译为 WASM： rustup target add...

CVE-2021-38297-Go-wasm-Replication

🚨 CVE-2021-38297 の悪用: GO Wasm バッファオーバーフローへの道のり 🚨 🌐 脆弱性の概要 🌐 WebAssembly WASM 🌍 は、C、C++、Rust、GO などの高級言語を最新の Web ブラウザーでシームレスに実行できるようにする、最先端のバイナリ命令形式です。しかし、CVE-2021-38297 🚩 の発見により、GO でコンパイルされた WASM バイナリに対する GO のコンパイルおよびロード処理に重大な欠陥があることが明らかになりました。GO が提供する JavaScript WASM ローダー wasmexec.js...

JLSEC-2026-1350 Wasmtime provides unsound API access to a WebAssembly shared linear memory

Impact Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host Rust to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in paralle...

JLSEC-2026-1362 Wasmtime has data leakage between pooling allocator instances

Impact Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the virtual memory permissions for linear memory used the wrong predicate to determin...

EUVD-2026-21033

Wasmtime has data leakage between pooling allocator instances...

DEBIAN-CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

CVE-2026-34941

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds chec...

CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-35186 Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-34988 Wasmtime leaks data between pooling allocator instances

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

CVE-2026-34987

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch...

CVE-2026-34987: Out-of-bounds Read

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch...

PT-2026-31691

Name of the Vulnerable Software and Affected Versions Wasmtime versions 28.0.0 through 36.0.6, 42.0.2 and 43.0.1 Description Wasmtime's pooling allocator implementation contains a flaw where linear memory contents can leak between WebAssembly instances under specific configurations. This occurs d...

CVE-2026-34988: Improper Restriction of Operations within the Bounds of a Memory Buffer

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix crypto buffers in non-linear memory The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this by using the cifssgsetbuf helper function, which converts vmalloc’d...

CVE-2025-66627 Wasmi's Linear Memory has a Critical Use After Free Vulnerability

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory...

CVE-2025-66627 Wasmi's Linear Memory has a Critical Use After Free Vulnerability

Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 through 0.51.2 and 1.0.0, Wasmi's linear memory implementation leads to a Use After Free vulnerability, triggered by a WebAssembly module under certain memory...