CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

DEBIAN-CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-53901

Wasmtime WASI (wasmtime-wasi) contains a bug in the WASIp1 import implementation. Prior to 24.0.4, 33.0.2, and 34.0.2, calling fd_renumber followed by path_open can cause a WebAssembly guest to panic the host (embedder). The panic results from a corrupt state in fd_renumber when a second open fil...

CVE-2025-53901 Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

PT-2025-30073 · Bytecode Alliance · Wasmtime

Name of the Vulnerable Software and Affected Versions: Wasmtime versions 24.0.0 through 24.0.3 Wasmtime versions 33.0.0 through 33.0.1 Wasmtime versions 34.0.0 through 34.0.1 Description: Wasmtime is a runtime for WebAssembly. A bug in Wasmtime's implementation of the WASIp1 set of import functio...

libwasmtime -- host panic with fd_renumber WASIp1 function

WasmTime development team reports: A bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder...

Bytecode Alliance Wasmtime 安全漏洞

Bytecode Alliance Wasmtime is a standalone WebAssembly and WASI-only wasm optimization software open-sourced by Bytecode Alliance. A security vulnerability exists in Bytecode Alliance Wasmtime versions prior to 24.0.4, 33.0.2, and 34.0.2, which stems from a WASIp1 implementation flaw that could...

Running Serverless Wasm Functions on the Edge with k3s and SpinKube

...

CVE-2025-6275

A use-after-free vulnerability has been discovered in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the GetFuncOffset function. This flaw can be triggered by an attacker with local system access through the manipulation of input provided to this function. Successful...

CVE-2025-6274

A denial-of-service vulnerability has been identified in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the OnDataCount function. This flaw allows an attacker with local access to trigger runaway resource consumption for example, excessive memory or CPU usage by manipulating...

CVE-2025-6273

A denial-of-service vulnerability has been identified in WebAssembly's WebAssembly Binary Toolkit wabt, specifically within the LogOpcode function. This flaw allows an attacker with local access to trigger a program crash by manipulating input data, leading to a reachable assertion in the code pa...

CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

DEBIAN-CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

UBUNTU-CVE-2025-6275

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275

CVE-2025-6275 concerns WebAssembly wabt up to 1.0.37. The vulnerability affects the function GetFuncOffset in src/interp/binary-reader-interp.cc, where manipulation can lead to a use-after-free. It permits a local attack, with at least one public disclosure of an exploit. Connected sources consis...

CVE-2025-6275 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...

CVE-2025-6275 WebAssembly wabt binary-reader-interp.cc GetFuncOffset use after free

A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local...