CVE-2022-39394 wasmtime_trap_code C API function has out of bounds write vulnerability
A memory corruption vulnerability in the Wasmtime C API allows out-of-bounds writes, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39394?
CVE-2022-39394 is a low-severity memory corruption vulnerability in bytecodealliance wasmtime, published on 10 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.
Weakness: CWE-787
Which versions are affected by CVE-2022-39394?
5 open source packages ship an affected version, including wasmtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | All versions | 1.0.2 |
wasmtime crates.io | All versions | 1.0.2 |
wasmtime crates.io | From 0.0.0-0 | 1.0.2, 2.0.2 |
wasmtime crates.io | From 2.0.0 | 2.0.2 |
wasmtime crates.io | From 2.0.0 | 2.0.2 |
Products include Bytecodealliance Wasmtime.
How do I fix CVE-2022-39394?
Upgrade wasmtime to a fixed version for your release line: 1.0.2 or 2.0.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-39394 being exploited?
There is no known exploitation of CVE-2022-39394 in the wild and no public exploit code.
Other vulnerabilities in bytecodealliance wasmtime
- CVE-2026-34971 Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
- CVE-2026-34987 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
- CVE-2022-39393 Wasmtime vulnerable to data leakage between instances in the pooling allocator
- CVE-2022-24791 Use after free in Wasmtime
- CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Sources
Also known as GHSA-h84q-m8rr-3v9q, RUSTSEC-2022-0097, UBUNTU-CVE-2022-39394.