# CVE-2021-39218: Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

> Wasmtime runtime suffers from memory corruption via invalid free and out-of-bounds access when handling externrefs during garbage collection.

- **Severity:** Medium 6.3 (`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Sep 2021
- **Updated:** 4 Aug 2024

## What is CVE-2021-39218?

CVE-2021-39218 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 17 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.

Weakness: CWE-787 (Out-of-bounds Write), CWE-590 (Free of Memory not on the Heap), CWE-125 (Out-of-bounds Read)

## Which versions are affected by CVE-2021-39218?

It affects 2 products.


Products: Bytecodealliance Wasmtime, Fedoraproject Fedora.

## How do I fix CVE-2021-39218?

Upgrade to a fixed version.

## Is CVE-2021-39218 being exploited?

There is no known exploitation of CVE-2021-39218 in the wild and no public exploit code.

## Other vulnerabilities in Fedoraproject Fedora

- [CVE-2026-34971](https://insights.sbomify.com/CVE-2026-34971/): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift (critical 9.0)
- [CVE-2026-34987](https://insights.sbomify.com/CVE-2026-34987/): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access (critical 9.0)
- [CVE-2022-39393](https://insights.sbomify.com/CVE-2022-39393/): Wasmtime vulnerable to data leakage between instances in the pooling allocator (high 8.6)
- [CVE-2022-24791](https://insights.sbomify.com/CVE-2022-24791/): Use after free in Wasmtime (high 8.1)
- [CVE-2026-47261](https://insights.sbomify.com/CVE-2026-47261/): Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction (high 7.5)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2021-39218 and fix it if it is affected.

What it is: CVE-2021-39218 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 17 Sep 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2021-39218 in the wild and no public exploit code.

Affected product: Fedoraproject Fedora. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2021-39218/ (Markdown: https://insights.sbomify.com/CVE-2021-39218/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2021-39218
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-39218
- OSV: https://osv.dev/vulnerability/CVE-2021-39218

---
From sbomify Insights: https://insights.sbomify.com/CVE-2021-39218/
Summaries are generated and may contain mistakes; the official description above is the record.