Linux Distros Unpatched Vulnerability : CVE-2026-104855

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy,...

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

CVE-2026-104855

A flaw was found in wasmtime. Execution preemption checks during bulk operations can expose an invalid intermediate state if an application mutates or continues using the execution store after a cancellation or trap. Under these conditions, an attacker executing WebAssembly code can cause memory...

EUVD-2026-91765

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

CVE-2026-104855

The Wasmtime runtime (versions 46.0.0 to 46.0.2 and 47.0.3 ) is vulnerable to a flaw where fuel and epoch preemption checks during bulk operations (such as memory.copy, table.grow, and array.copy) can expose invalid intermediate states . If an embedder mutates a Store during a Store::epoch_deadli...

CVE-2026-104855 Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epochdeadlinecallback or continues...

RUSTSEC-2026-0324 Guest can panic host through filesystem timestamp before the epoch on wasip3

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory...

Guest can panic host through filesystem datetime overflow

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory...

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory...

Outgoing HTTP body write allows guest-driven host memory exhaustion

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory...

Dynamic record lifting can allocate beyond the hostcall fuel limit

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory...

CLEANSTART-2026-OG35217 Security fix for CVE-2026-25541 applied in: wasmtime 40.0.0-r0, ztunnel-fips 1.27.8-r4

CVE-2026-25541 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

EUVD-2026-41136

Wasmtime has a leak in WASIp1 fdrenumber implementation...

GHSA-3P27-QVP9-27QF Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

JLSEC-2026-1361 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Impact Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler -Ccompiler=winch. By default, Wasmtime uses its Cranelift backend, not...

JLSEC-2026-1359 Wasmtime has host panic when Winch compiler executes `table.fill`

Impact Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability i...

JLSEC-2026-1360 Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Impact Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging...

JLSEC-2026-1363 Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Impact Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid...

JLSEC-2026-1350 Wasmtime provides unsound API access to a WebAssembly shared linear memory

Impact Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host Rust to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in paralle...