Is wasmtime safe to use? Its security history

Every advisory, newest first

• VulnerabilityRUSTSEC-2026-0378 · 2026-10-19Panic lowering a host-created component model stream into a guest that expects a different payload type
• Vulnerability CriticalRUSTSEC-2026-0379 · 2026-10-19Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
• Vulnerability CriticalRUSTSEC-2026-0380 · 2026-10-19Bit-packing in Cranelift compiler causes silent overflow and miscompilation
• VulnerabilityRUSTSEC-2026-0353 · 2026-10-14Panic when invoking an async-lifted function via `call`
• VulnerabilityRUSTSEC-2026-0354 · 2026-10-14Host panic when component `call_async` is cancelled under some conditions
• VulnerabilityRUSTSEC-2026-0355 · 2026-10-14Panic viewing component model stream or future as the wrong type
• Vulnerability MediumRUSTSEC-2026-0356 · 2026-10-14Panic on erroneous call-to-host from guest realloc call
• VulnerabilityRUSTSEC-2026-0357 · 2026-10-14Out-of-bounds zero-length stream writes can panic
• VulnerabilityRUSTSEC-2026-0358 · 2026-10-14Yielding in a component start function can lead to a host panic
• Vulnerability MediumRUSTSEC-2026-0359 · 2026-10-14Stack overflow dropping a long chain of recursive types
• VulnerabilityRUSTSEC-2026-0360 · 2026-10-14Overlapping string transcode in a fused adapter can panic
• VulnerabilityRUSTSEC-2026-0361 · 2026-10-14Panic when pending calls are run after a trap
• VulnerabilityRUSTSEC-2026-0362 · 2026-10-14Wasmtime may not properly enforce async-entrypoint requirement
• Vulnerability MediumRUSTSEC-2026-0363 · 2026-10-14Component-model handle tables are capped only per instance and charged to no limit
• VulnerabilityRUSTSEC-2026-0364 · 2026-10-14Exception tags can cause host data structures to be unaligned
• VulnerabilityRUSTSEC-2026-0325 · 2026-10-02Mis-typed WebAssembly tag imports can lead to GC heap corruption
• Vulnerability MediumRUSTSEC-2026-0326 · 2026-10-02Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
• VulnerabilityRUSTSEC-2026-0327 · 2026-10-02Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
• Vulnerability MediumRUSTSEC-2026-0315 · 2026-09-24`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
• VulnerabilityRUSTSEC-2026-0316 · 2026-09-24Dynamic record lifting can allocate beyond the hostcall fuel limit
• VulnerabilityRUSTSEC-2026-0268 · 2026-08-20Guest controlled-size host heap allocation through WASIp3 streams
• VulnerabilityRUSTSEC-2026-0269 · 2026-08-20Filesystem sandbox escape when paths or symlinks contain trailing slashes
• Vulnerability LowRUSTSEC-2026-0222 · 2026-07-31Stores can mix up type indices between engines
• VulnerabilityRUSTSEC-2026-0223 · 2026-07-31Preemption and traps during bulk operations enable breaking internal VM state
• VulnerabilityRUSTSEC-2026-0114 · 2026-04-30Panic when allocating a table exceeding the size of the host's address space
• VulnerabilityRUSTSEC-2026-0085 · 2026-04-09Panic when lifting `flags` component value
• VulnerabilityRUSTSEC-2026-0086 · 2026-04-09Host data leakage with 64-bit tables and Winch
• VulnerabilityRUSTSEC-2026-0087 · 2026-04-09Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
• VulnerabilityRUSTSEC-2026-0088 · 2026-04-09Data leakage between pooling allocator instances
• VulnerabilityRUSTSEC-2026-0089 · 2026-04-09Host panic when Winch compiler executes `table.fill`
• VulnerabilityRUSTSEC-2026-0090 · 2026-04-09Use-after-free bug after cloning `wasmtime::Linker`
• VulnerabilityRUSTSEC-2026-0091 · 2026-04-09Out-of-bounds write or crash when transcoding component model strings
• VulnerabilityRUSTSEC-2026-0092 · 2026-04-09Panic when transcoding misaligned component model UTF-16 strings
• VulnerabilityRUSTSEC-2026-0093 · 2026-04-09Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
• VulnerabilityRUSTSEC-2026-0094 · 2026-04-09Improperly masked return value from `table.grow` with Winch compiler backend
• VulnerabilityRUSTSEC-2026-0095 · 2026-04-09Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access
• VulnerabilityRUSTSEC-2026-0096 · 2026-04-09Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
• VulnerabilityRUSTSEC-2026-0020 · 2026-02-24Guest-controlled resource exhaustion in WASI implementations
• VulnerabilityRUSTSEC-2026-0021 · 2026-02-24Panic adding excessive fields to a `wasi:http/types.fields` instance
• VulnerabilityRUSTSEC-2026-0022 · 2026-02-24Panic when dropping a `[Typed]Func::call_async` future
• VulnerabilityRUSTSEC-2026-0006 · 2026-01-26Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64
• Vulnerability LowRUSTSEC-2025-0118 · 2025-11-11Unsound API access to a WebAssembly shared linear memory
• Vulnerability LowRUSTSEC-2025-0046 · 2025-07-18Host panic with `fd_renumber` WASIp1 function
• VulnerabilityRUSTSEC-2025-0112 · 2025-07-18Possible host crash with host-to-wasm component intrinsics
• VulnerabilityRUSTSEC-2024-0438 · 2024-11-02Wasmtime doesn't fully sandbox all the Windows device filenames
• Vulnerability LowRUSTSEC-2024-0439 · 2024-10-03Race condition could lead to WebAssembly control-flow integrity and type safety violations
• Vulnerability MediumRUSTSEC-2024-0440 · 2024-10-02Runtime crash when combining tail calls with stack traces
• Vulnerability LowRUSTSEC-2024-0441 · 2024-04-02Panic when using a dropped extenref-typed element segment
• Vulnerability LowRUSTSEC-2023-0091 · 2023-09-05Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
• Vulnerability LowRUSTSEC-2023-0092 · 2023-04-21Undefined Behavior in Rust runtime functions
• Vulnerability LowRUSTSEC-2023-0093 · 2023-03-03Miscompilation of `i8x16.select` with the same inputs on x86\_64
• Vulnerability CriticalRUSTSEC-2023-0090 · 2023-03-02Guest-controlled out-of-bounds read/write on x86\_64
• VulnerabilityRUSTSEC-2022-0075 · 2022-11-10Bug in pooling instance allocator
• Vulnerability HighRUSTSEC-2022-0076 · 2022-11-10Bug in Wasmtime implementation of pooling instance allocator
• Vulnerability LowRUSTSEC-2022-0097 · 2022-11-07Out of bounds write in `wasmtime_trap_code` C API function
• Vulnerability HighRUSTSEC-2022-0098 · 2022-11-05Data leakage between instances in the pooling allocator
• Vulnerability MediumRUSTSEC-2022-0102 · 2022-11-05Out of bounds read/write with zero-memory-pages configuration
• VulnerabilityRUSTSEC-2022-0100 · 2022-07-12Use After Free with `externref`s in Wasmtime
• VulnerabilityRUSTSEC-2022-0101 · 2022-07-05Miscompilation of constant values in division on AArch64
• VulnerabilityRUSTSEC-2022-0095 · 2022-06-27Miscompilation of `i8x16.swizzle` and `select` with v128 inputs
• VulnerabilityRUSTSEC-2022-0016 · 2022-03-31Use after free with `externref`s and epoch interruption in Wasmtime
• VulnerabilityRUSTSEC-2022-0099 · 2022-03-28 Use after free with `externref`s and epoch interruption in Wasmtime
• VulnerabilityRUSTSEC-2022-0096 · 2022-02-17Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
• Vulnerability MediumRUSTSEC-2021-0110 · 2021-09-17Multiple Vulnerabilities in Wasmtime

Check your version

Run cargo tree -i wasmtime to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.