Executive brief
Use After Free with `externref`s in Wasmtime
Affected products
- crates.io wasmtime
- crates.io cranelift-codegen
Junglewise Threat Intelligence
CVE-2022-31146: RUSTSEC-2022-0100 - Use After Free with `externref`s in Wasmtime
CVE-2022-31146 · Severity: low · CVSS 3.1 · Published 2022-07-12
Technologies: wasmtime (crates.io), cranelift-codegen (crates.io). Vendors: crates.io.
Related threats
- RUSTSEC-2026-0269 - Filesystem sandbox escape when paths or symlinks contain trailing slashes
- RUSTSEC-2026-0268 - Guest controlled-size host heap allocation through WASIp3 streams
- RUSTSEC-2026-0222 - Stores can mix up type indices between engines
- RUSTSEC-2026-0223 - Preemption and traps during bulk operations enable breaking internal VM state
- Bytecode Alliance Wasmtime denial of service via table allocation panic