Critical Memory Access Vulnerability in Wasmtime: UNKNOWN READ Issue
Summary
OSV-2026-603: UNKNOWN READ in ::call_unchecked_raw::. Affects wasmtime versions >= d3f444c876d71724dca6b40a58a55e8a450a7967, < eb7a3f61290ac9e82fe7d760fb569bb3f3fc657a. Fixed in eb7a3f61290ac9e82fe7d760fb569bb3f3fc657a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT (Just-In-Time) compiler for WebAssembly, designed to run WebAssembly code efficiently and securely. It provides a runtime environment for executing WebAssembly modules, enabling developers to leverage WebAssembly's performance benefits in various applications. However, a recent vulnerability has been identified that could lead to unauthorized memory access, potentially compromising the integrity of applications using Wasmtime.
Vulnerability Detail
The vulnerability arises from an UNKNOWN READ condition in the function call implementation of Wasmtime. This issue can lead to crashes or unexpected behavior when executing WebAssembly code, as it allows for reading from uninitialized memory. The crash state indicates that the vulnerability is triggered during the execution of the call_unchecked_raw function, which is a critical part of the runtime's function calling mechanism. If exploited, this vulnerability could lead to application crashes or even arbitrary code execution, posing a significant risk to applications relying on Wasmtime.
How To Fix
Minimum fixed version
eb7a3f61290ac9e82fe7d760fb569bb3f3fc657a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function calls until they have updated to the patched version. It is advisable to review the application code to ensure that any calls to call_unchecked_raw are replaced with safer alternatives that do not expose the application to this vulnerability.
Conclusion
In summary, the UNKNOWN READ vulnerability in Wasmtime poses a significant risk to applications using this runtime environment. It is crucial for developers to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring the safety of your applications.
See every vulnerability recorded for wasmtime →
FAQ
The UNKNOWN READ vulnerability allows for reading from uninitialized memory, which can lead to crashes or unexpected behavior in applications using Wasmtime.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Exploiting this vulnerability could lead to application crashes or arbitrary code execution, posing a significant risk to the integrity and security of applications using Wasmtime.
Yes, you should upgrade to at least version eb7a3f61290ac9e82fe7d760fb569bb3f3fc657a, which contains the necessary fixes for this vulnerability.
You can find more information about Wasmtime and its features on the official GitHub repository at https://github.com/bytecodealliance/wasmtime.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
