# CVE-2024-27529: Wasm3 uncontrolled memory allocation in Read_utf8

Source: https://junglewise.ai/threats/cve-2024-27529-wasm3-uncontrolled-memory-allocation-in-read-utf8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-09. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2024-27529 · Severity: high · CVSS 8.4 · Published 2024-11-09

Wasm3, a high-performance WebAssembly interpreter, is vulnerable to a memory leak when processing specially crafted files. An attacker could provide a malicious WebAssembly binary that causes the application to consume excessive memory, potentially leading to a system crash or service outage. This affects applications using Wasm3 to run untrusted code in environments like IoT devices, mobile apps, or web services.

Technologies: [wasm3 (crates.io)](https://junglewise.ai/threats/technologies/wasm3), [pywasm3 (PyPI)](https://junglewise.ai/threats/technologies/pywasm3). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Swift](https://junglewise.ai/threats/vendors/swift).

## Quick answers

**Is CVE-2024-27529 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-27529 being exploited in the wild.

**How severe is CVE-2024-27529?** High severity, with a CVSS score of 8.4, published 9 November 2024.

**Which products and versions are affected?** wasm3 (crates.io) <= 0.3.1; pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=139076a; github.com/shareup/wasm-interpreter-apple (Swift) <= 0.8.1.

**Is there a fix for CVE-2024-27529?** A patch was published on 2024-08-02: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-27529 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2024-27529?** Check whether you run wasm3 (crates.io), pywasm3 (PyPI) or github.com/shareup/wasm-interpreter-apple (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak exists in Wasm3 (specifically at commit 139076a and earlier) within the Read_utf8 function and M3Module memory import handling. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-125 (Out-of-bounds Read). An attacker can exploit this by providing a crafted WebAssembly (.wasm) binary that triggers underruns or failed releases of allocated memory during parsing. This can lead to a Denial of Service (DoS) through memory exhaustion. While some metrics suggest local access, the nature of WebAssembly interpreters often involves processing remote content, extending the risk to network vectors. A fix was merged in commit 526c125.

## Affected products

- wasm3 project wasm3 <= 0.3.1 (Rust), <= 0.5.0 (pip), <= 0.8.1 (Swift)

## Identifiers

- CVE-2024-27529
- GHSA-fmq6-4w57-2w3v
- PYSEC-2024-305

## Timeline

- 2024-02-19: disclosed: Issue reported on GitHub
- 2024-08-02: patched: Fix merged into main branch
- 2024-11-08: advisory: NVD publication date
- 2024-11-09: advisory: GitHub Advisory published

## References

- [https://github.com/wasm3/wasm3/issues/462](https://github.com/wasm3/wasm3/issues/462)
- [https://gist.github.com/haruki3hhh/ac70bd83b9c0ed1de6289d818488da78](https://gist.github.com/haruki3hhh/ac70bd83b9c0ed1de6289d818488da78)
- [https://github.com/wasm3/wasm3/pull/490](https://github.com/wasm3/wasm3/pull/490)
- [https://github.com/wasm3/wasm3/commit/526c1251b64e6e9fdc0d40c768ae46cd20338594](https://github.com/wasm3/wasm3/commit/526c1251b64e6e9fdc0d40c768ae46cd20338594)
- [https://github.com/pypa/advisory-database/tree/main/vulns/pywasm3/PYSEC-2024-305.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/pywasm3/PYSEC-2024-305.yaml)

## Related threats

- [wasm3 and pywasm3 out-of-bounds write in MarkSlotAllocated](https://junglewise.ai/threats/cve-2025-6272-wasm3-and-pywasm3-out-of-bounds-write-in-markslotallocated)
- [wasm3 pywasm3 use-after-free in ForEachModule](https://junglewise.ai/threats/cve-2024-27530-wasm3-pywasm3-use-after-free-in-foreachmodule)
- [wasm3 pywasm3 out-of-bounds read in m3_exec.h](https://junglewise.ai/threats/cve-2024-27528-wasm3-pywasm3-out-of-bounds-read-in-m3-exec-h)
- [PYSEC-2024-303 - wasm3 139076a is vulnerable to Denial of Service (DoS).](https://junglewise.ai/threats/cve-2024-27527-pysec-2024-303-wasm3-139076a-is-vulnerable-to-denial-of-service)
- [PYSEC-2024-307 - wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault…](https://junglewise.ai/threats/cve-2024-34246-pysec-2024-307-wasm3-v0-5-0-was-discovered-to-contain-an-out-of)