{"id":"EUVD-2024-0651","revision":"5c70de79fce049a8a90a9cb1155d86f8","records":[{"revision":"5c70de79fce049a8a90a9cb1155d86f8","observedAt":"2026-11-03T22:08:32.557+00:00","statement":{"source":"euvd","id":"EUVD-2024-0651","aliases":["CVE-2022-39394","GHSA-h84q-m8rr-3v9q"],"title":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` head…","description":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","score":3.8,"severity":null}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q","https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0651","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 10, 2022, 12:00:00 AM","dateUpdated":"Apr 23, 2025, 4:39:05 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-0651","identifiers":["EUVD-2024-0651","CVE-2022-39394","GHSA-h84q-m8rr-3v9q"]},"retained":false,"historicalAffected":[]}],"coverage":[]}