CVE-2023-27477

wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.

• CWE-193

• https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simdProduct
• https://github.com/bytecodealliance/wasmtime/commit/5dc2bbccbb363e474d2c9a1b8e38a89a43bbd5d1Patch
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vwMitigation, Patch, Vendor Advisory
• https://github.com/webassembly/simdNot Applicable
• https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/Mov-ItrNJsQMailing List, Release Notes, Vendor Advisory
• https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simdProduct
• https://github.com/bytecodealliance/wasmtime/commit/5dc2bbccbb363e474d2c9a1b8e38a89a43bbd5d1Patch
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vwMitigation, Patch, Vendor Advisory
• https://github.com/webassembly/simdNot Applicable
• https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/Mov-ItrNJsQMailing List, Release Notes, Vendor Advisory

Published

Mar 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27470BASupSrvcUpdater.exe in N-able Take Control Agent through 7.…7
• CVE-2023-27471An issue was discovered in Insyde InsydeH2O with kernel 5.0 …5.5
• CVE-2023-27472 quickentity-editor-next is an open source, system local, vi…6.1
• CVE-2023-27474Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2023-27475Goutil is a collection of miscellaneous functionality for th…8.8
• CVE-2023-27476OWSLib is a Python package for client programming with Open …7.5
• CVE-2023-27478libmemcached-awesome is an open source C/C++ client library …6.5
• CVE-2023-27479XWiki Platform is a generic wiki platform offering runtime s…9.9
• CVE-2023-27480XWiki Platform is a generic wiki platform offering runtime s…7.7
• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5