libwasmtime -- Multiple vulnerabilities

2026-10-11 · VuXML entry

Wasmtime development team reports: Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. Mis-typed WebAssembly tag imports can lead to GC heap corruption. Rooting for GC values live across try_call may be missing, causing GC heap corruption. Excessive allocated memory on the host when guests don't have stdio. Guest can panic host through filesystem timestamp …

Affected versions

• libwasmtime, wasmtime < 36.0.17; >= 37.0.0 < 48.0.4; >= 49.0.0 < 49.0.2

By system

0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.