CVE-2022-24791

Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free. Patches have been released in versions 0.34.2 and 0.35.2, which fix the vulnerability. All Wasmtime users are recommended to upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either: disabling the Wasm reference types proposal, config.wasm_reference_types(false); or by disabling epoch interruption if you were previously enabling it. config.epoch_interruption(false).

• CWE-416

• https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888aPatch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2Mitigation, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/commit/666c2554ea0e1728c35aa41178cf235920db888aPatch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2Mitigation, Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24786PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-24787Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2022-24788Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2022-24789C1 CMS is an open-source, .NET based Content Management Syst…7.6
• CVE-2022-2479Insufficient validation of untrusted input in File in Google…4.3
• CVE-2022-24790Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 se…7.5
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8
• CVE-2022-24797Pomerium is an identity-aware access proxy. In distributed s…9.1