{"id":"CVE-2024-30266","revision":"6d4797d89b69439a9de90bba6d70810e","records":[{"revision":"6d4797d89b69439a9de90bba6d70810e","observedAt":"2026-10-24T23:17:34.532+00:00","statement":{"source":"nvd","id":"CVE-2024-30266","aliases":[],"title":"wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when…","description":"wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.","state":0,"publishedAt":"2024-04-04T16:15:09.107+00:00","modifiedAt":"2026-06-17T07:26:38.3+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":3.3,"severity":"LOW"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5,"severity":"MEDIUM"}],"references":["https://github.com/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10e8664","https://github.com/bytecodealliance/wasmtime/issues/8281","https://github.com/bytecodealliance/wasmtime/pull/8018","https://github.com/bytecodealliance/wasmtime/pull/8283","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-30266","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-843"],"productCriteria":["cpe:2.3:a:bytecodealliance:wasmtime:19.0.0:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2024-04-04T16:15:09.107","lastModified":"2026-06-17T07:26:38.300"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-30266","identifiers":["CVE-2024-30266"]},"retained":false,"historicalAffected":[]}],"coverage":[]}