CVE-2022-31169

Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can result in incorrect division results at runtime. This affects Wasmtime prior to version 0.38.2 and Cranelift prior to 0.85.2. This issue only affects the AArch64 platform. Other platforms are not affected. The translation rules for constants did not take into account whether sign or zero-extension should happen which resulted in an incorrect value being placed into a register when a division was encountered. The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly but does affect the correctness of guest programs. This bug has been patched in Wasmtime version 0.38.2 and cranelift-codegen 0.85.2. There are no known workarounds.

• CWE-682

• https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41Patch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/commit/2ba4bce5cc719e5a74e571a534424614e62ecc41Patch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7f6x-jwh5-m9r4Third Party Advisory

Published

Jul 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31162Slack Morphism is an async client library for Rust. Prior to…7.5
• CVE-2022-31163TZInfo is a Ruby library that provides access to time zone d…8.1
• CVE-2022-31164Tovy is a a staff management system for Roblox groups. A vul…7.5
• CVE-2022-31166XWiki Platform Old Core is a core package for XWiki Platform…8.8
• CVE-2022-31167XWiki Platform Security Parent POM contains the security API…6.5
• CVE-2022-31168Zulip is an open source team chat tool. Due to an incorrect …8.8
• CVE-2022-3117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31173Juniper is a GraphQL server library for Rust. Affected versi…7.5
• CVE-2022-31175CKEditor 5 is a JavaScript rich text editor. A cross-site sc…4.7