{"id":"EUVD-2024-0651","enisaUuid":"bfbdcf64-f997-3e38-be1c-e53bd7fae35a","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime\u0027s C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","datePublished":"Nov 10, 2022, 12:00:00 AM","dateUpdated":"Apr 23, 2025, 4:39:05 PM","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q\nhttps://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36\n","aliases":"CVE-2022-39394\nGHSA-h84q-m8rr-3v9q\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"011fe547-71ca-3487-a630-7ca8fb505b47","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 2.0.2"}],"enisaIdVendor":[{"id":"d2ad67c0-52e0-39d6-8ffb-8c61bf931dbe","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"1f9fa6f7-95aa-3677-a706-d96eb286b0a4","vulnerability":{"id":"CVE-2022-39394","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime\u0027s C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","datePublished":"Nov 10, 2022, 12:00:00 AM","dateUpdated":"Apr 23, 2025, 4:39:05 PM","status":"PUBLISHED","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q\nhttps://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36\n","enisa_id":"EUVD-2024-0651\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 3, 2026, 7:14:38 AM","vulnerabilityProduct":[{"id":"2662c9e1-bb4a-3e0c-a6da-2fa5d5f4699a","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 2.0.2"},{"id":"504edc96-c164-401e-877c-f9ec0da2f9f1","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"\u003c 2.0.2"}],"vulnerabilityVendor":[{"id":"ca61f102-0caa-30f4-8981-506fb6f67b1f","vendor":{"name":"bytecodealliance"}}]}},{"id":"2bc66d56-289c-3211-9eae-733edee8f68a","vulnerability":{"id":"GHSA-h84q-m8rr-3v9q","description":"wasmtime_trap_code C API function has out of bounds write vulnerability","datePublished":"Feb 1, 2024, 12:15:47 AM","dateUpdated":"May 2, 2025, 12:51:45 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-39394\nhttps://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36\nhttps://github.com/bytecodealliance/wasmtime/commit/5b6d5e78de106503b3b9add218bb3d2b1d63c493\nhttps://github.com/bytecodealliance/wasmtime\nhttps://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/c1HBDDJwNPA\nhttps://rustsec.org/advisories/RUSTSEC-2022-0097.html\n","enisa_id":"EUVD-2024-0651\n","aliases":"CVE-2022-39394\nGHSA-h84q-m8rr-3v9q\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:08:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}