PkgSeer

Vulnerability RUSTSEC-2026-0087

Unknown

6 months ago

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

0.0.0 - 24.0.6

Summary

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv For more information see the GitHub-hosted security advisory.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

46.0.0 - 46.0.1 and 47.0.0 - 47.0.2 GHSA-2hw9-mc66-jc2q

Mis-typed WebAssembly tag imports can lead to GC heap corruption

47.0.0 - 48.0.3 RUSTSEC-2026-0325

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

47.0.0 - 48.0.3 RUSTSEC-2026-0326

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

39.0.0 - 48.0.3 RUSTSEC-2026-0327

`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification

47.0.0 - 48.0.2 RUSTSEC-2026-0315

View all vulnerabilities for these packages

Impacted packages

wasmtime

Timeline

Published

6 months ago

Fixed (24.0.7)

6 months ago

Fixed (36.0.7)

6 months ago

Fixed (43.0.1)

6 months ago

Fixed (42.0.2)

6 months ago

Last Modified

1 hour ago