CVE-2024-30266 json
Wasmtime vulnerable to panic when using a dropped extenref-typed element segment
published 2024-04-02 2 y ago modified 2026-10-12 27 d ago also EUVD-2024-1137 , GHSA-75hq-h6g9-h4q5 , PYSEC-2024-327 , RUSTSEC-2024-0441
- cvss
- 3.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.
Patch / fix
- crates.io wasmtime 19.0.1
- bytecodealliance wasmtime 19.0.1
- rust-wasmtime Debian 14, Debian 13 21.0.2+dfsg-1
debian advisories DEBIAN-CVE-2024-30266
- github.com/bytecodealliance/wasmtime@7f57d0b commit
- github.com/bytecodealliance/wasmtime#8018 pull request
- github.com/bytecodealliance/wasmtime#8283 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/bytecodealliance/wasmtime/issues/8281 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime | >=19.0.0, <19.0.1 |
19.0.1 |
| pypi | wasmtime | <=19.0.0 |
no fix listed |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-843 Access of Resource Using Incompatible Type
References
-
github.com
/bytecodealliance/wasmtime/pull/8018
web, patch
-
github.com
/bytecodealliance/wasmtime/pull/8283
web, patch
-
github.com
/bytecodealliance/wasmtime/commit/7f57d0bb0948fa56cc950278d0db230ed10e8664
web, patch
-
github.com
/bytecodealliance/wasmtime/issues/8281
web, exploit, issue-tracking, report
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-75hq-h6g9-h4q5
web, mitigation, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-30266
advisory
-
github.com
/bytecodealliance/wasmtime
package
-
rustsec.org
/advisories/RUSTSEC-2024-0441.html
web, advisory
-
crates.io
/crates/wasmtime
package
Sources
- CVE List CVE-2024-30266
- GitHub Advisory GHSA-75hq-h6g9-h4q5
- NVD CVE-2024-30266
- OSV PYSEC-2024-327
- OSV RUSTSEC-2024-0441
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.