Critical Memory Write Vulnerability in Wasmtime Package
Summary
OSV-2026-292: UNKNOWN WRITE in ::call_unchecked_raw::. Affects wasmtime versions >= d54924aa387d9471a5be3de635e1243a63681342, < c07c94d2f69265cb0661e446a4daee0de5e69cf1. Fixed in c07c94d2f69265cb0661e446a4daee0de5e69cf1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly modules efficiently and securely. It provides a powerful API for developers to integrate WebAssembly into their applications, enabling high-performance execution of code written in various languages. However, a recent vulnerability has been identified that could lead to memory corruption, potentially compromising the integrity and security of applications utilizing this package.
Vulnerability Detail
The vulnerability is characterized as an UNKNOWN WRITE in the function call_unchecked_raw within the Wasmtime runtime. This issue arises from improper handling of memory during the execution of WebAssembly functions, which can lead to crashes or unexpected behavior. The vulnerability was reported through OSS-Fuzz, indicating its severity and potential impact on applications relying on Wasmtime for WebAssembly execution. If exploited, this could allow an attacker to manipulate memory, leading to data corruption or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
c07c94d2f69265cb0661e446a4daee0de5e69cf1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using the affected function call_unchecked_raw until the package is updated. This may involve refactoring code to utilize alternative methods provided by the Wasmtime API that do not trigger the vulnerability.
Conclusion
In summary, the Wasmtime package has a critical vulnerability that could lead to memory corruption. It is crucial for developers using this package to update to the latest version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability is an UNKNOWN WRITE that can lead to memory corruption in the Wasmtime runtime.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to application crashes, data corruption, or unauthorized access to sensitive information.
Yes, a patched version of the Wasmtime package is available. Users should update to the latest version to mitigate the risk.
If immediate updating is not possible, consider refactoring your code to avoid using the affected function as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
