FreeBSD : libwasmtime -- host panic with fd_renumber WASIp1 function (605a9d1e-6521-11f0-beb2-ac5afc632ba3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 605a9d1e-6521-11f0-beb2-ac5afc632ba3 advisory. WasmTime development team reports: A bug in Wasmtime's implementation of the WASIp1 set of import...

GHSA-FM79-3F68-H2FC Wasmtime CLI is vulnerable to host panic through its fd_renumber function

Summary A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling fdrenumber with either: - two equal argument values - second argument being equal...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

DEBIAN-CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901

Wasmtime WASI (wasmtime-wasi) contains a bug in the WASIp1 import implementation. Prior to 24.0.4, 33.0.2, and 34.0.2, calling fd_renumber followed by path_open can cause a WebAssembly guest to panic the host (embedder). The panic results from a corrupt state in fd_renumber when a second open fil...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

Bytecode Alliance Wasmtime security vulnerability

Bytecode Alliance Wasmtime is a standalone WebAssembly and WASI-only wasm optimization software open-sourced by Bytecode Alliance. A security vulnerability exists in Bytecode Alliance Wasmtime versions prior to 24.0.4, 33.0.2, and 34.0.2, which stems from a WASIp1 implementation flaw that could...

PT-2025-30073

Name of the Vulnerable Software and Affected Versions Wasmtime versions 24.0.0 through 24.0.3 Wasmtime versions 33.0.0 through 33.0.1 Wasmtime versions 34.0.0 through 34.0.1 Description Wasmtime is a runtime for WebAssembly. A bug in Wasmtime's implementation of the WASIp1 set of import functions...

libwasmtime -- host panic with fd_renumber WASIp1 function

WasmTime development team reports: A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder...

Running Serverless Wasm Functions on the Edge with k3s and SpinKube

...

CVE-2025-6275

A use-after-free vulnerability has been discovered in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the GetFuncOffset function. This flaw can be triggered by an attacker with local system access through the manipulation of input provided to this function. Successful...

CVE-2025-6274

A denial-of-service vulnerability has been identified in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the OnDataCount function. This flaw allows an attacker with local access to trigger runaway resource consumption for example, excessive memory or CPU usage by manipulating...

CVE-2025-6273

A denial-of-service vulnerability has been identified in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the LogOpcode function. This flaw allows an attacker with local access to trigger a program crash by manipulating input data, leading to a reachable assertion in the code pa...

DEBIAN-CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

UBUNTU-CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275

CVE-2025-6275 concerns WebAssembly wabt up to 1.0.37. The vulnerability affects the function GetFuncOffset in src/interp/binary-reader-interp.cc, where manipulation can lead to a use-after-free. It permits a local attack, with at least one public disclosure of an exploit. Connected sources consis...

CVE-2025-6275 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...