CVE-2022-39394

Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.

• CWE-787
• CWE-787

• https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36Patch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9qThird Party Advisory
• https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36Patch, Third Party Advisory
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9qThird Party Advisory

Published

Nov 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39388Istio is an open platform to connect, manage, and secure mic…3.5
• CVE-2022-39389Lightning Network Daemon (lnd) is an implementation of a lig…6.5
• CVE-2022-3939A vulnerability, which was classified as critical, has been …9.8
• CVE-2022-39390Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-39392Wasmtime is a standalone runtime for WebAssembly. Prior to v…7.4
• CVE-2022-39393Wasmtime is a standalone runtime for WebAssembly. Prior to v…8.6
• CVE-2022-39395Vela is a Pipeline Automation (CI/CD) framework built on Lin…9.9
• CVE-2022-39396Parse Server is an open source backend that can be deployed …9.8
• CVE-2022-39397aliyun-oss-client is a rust client for Alibaba Cloud OSS. Us…4.3
• CVE-2022-39398tasklists is a tasklists plugin for GLPI (Kanban). Versions …6.1
• CVE-2022-39399Vulnerability in the Oracle Java SE, Oracle GraalVM Enterpri…3.7
• CVE-2022-3940A vulnerability, which was classified as problematic, was fo…9.8