CVE-2023-26489: Wasmtime Guest-Controlled Out-of-Bounds Read/Write Vulnerability
Summary
CVE-2023-26489: Guest-controlled out-of-bounds read/write on x86\_64. Affects wasmtime across 3 version ranges.
>= 0.0.0-0, < 4.0.1
>= 5.0.0, < 5.0.1
>= 6.0.0, < 6.0.1
Fixed in 4.0.1, 5.0.1 or 6.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly modules efficiently and securely. It is widely used in various applications to enable safe execution of untrusted code. However, this package has been found to have a critical vulnerability that allows guest-controlled out-of-bounds read and write operations, potentially leading to severe security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2023-26489, arises from improper handling of memory access within the Wasmtime runtime. This flaw allows an attacker to manipulate memory access patterns, leading to out-of-bounds reads and writes. Such exploitation can result in data corruption, unauthorized access to sensitive information, or even arbitrary code execution. The vulnerability affects multiple versions of the Wasmtime package, specifically versions prior to 4.0.1, 5.0.1, and 6.0.1, making it critical for users to address this issue promptly.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 4.0.14.0.1 -
>= 5.0.0, < 5.0.15.0.1 -
>= 6.0.0, < 6.0.16.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit the permissions of the WebAssembly modules being executed to minimize the impact of this vulnerability. This can be done by configuring the runtime environment to restrict memory access and execution capabilities, although this does not fully mitigate the risk.
Conclusion
CVE-2023-26489 represents a critical vulnerability in the Wasmtime package that can lead to severe security risks through out-of-bounds memory access. Users are strongly advised to update to the latest patched versions to mitigate these risks effectively. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for wasmtime →
FAQ
CVE-2023-26489 is a security vulnerability in the Wasmtime package that allows guest-controlled out-of-bounds read and write operations, potentially leading to severe security issues.
Versions of Wasmtime prior to 4.0.1, 5.0.1, and 6.0.1 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2023-26489 is 9.9, indicating a critical level of severity.
If immediate updates are not possible, consider implementing strict permission controls on the WebAssembly modules to limit potential exploitation of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
