# CVE-2024-34249: wasm3 heap buffer overflow in DeallocateSlot

Source: https://junglewise.ai/threats/cve-2024-34249-wasm3-heap-buffer-overflow-in-deallocateslot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-06. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2024-34249 · Severity: critical · CVSS 9.8 · Published 2024-05-06

pywasm3 is a Python wrapper for Wasm3, a fast WebAssembly interpreter used to run portable code across different platforms. A memory management flaw allows a specially crafted WebAssembly file to crash the application or potentially execute unauthorized code. This could lead to service disruptions or the compromise of systems running untrusted WebAssembly modules.

Technologies: [pywasm3 (PyPI)](https://junglewise.ai/threats/technologies/pywasm3). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-34249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34249 being exploited in the wild.

**How severe is CVE-2024-34249?** Critical severity, with a CVSS score of 9.8, published 6 May 2024.

**Which products and versions are affected?** pywasm3 (PyPI) <= 0.5.0, ECOSYSTEM:introduced=0,last_affected=0.5.0.

**Is there a fix for CVE-2024-34249?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-34249 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-34249?** Check whether you run pywasm3 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in wasm3 v0.5.0 and its Python binding pywasm3 within the 'DeallocateSlot' function in 'm3_compile.c'. The vulnerability is triggered during the compilation phase of a WebAssembly module, specifically when handling nested blocks or stack operations that lead to an out-of-bounds memory access. An attacker can exploit this by providing a malicious .wasm file to be processed by the interpreter. Successful exploitation can result in a segmentation fault (DoS) or potentially remote code execution with the privileges of the application. As of the advisory date, no official patch has been released for version 0.5.0.

## Affected products

- wasm3 pywasm3 <= 0.5.0
- wasm3 wasm3 0.5.0

## Identifiers

- CVE-2024-34249
- GHSA-mq9p-qw76-q6h7
- PYSEC-2024-308

## Timeline

- 2024-05-06: disclosed: CVE-2024-34249 published
- 2024-05-06: advisory: GitHub Advisory GHSA-mq9p-qw76-q6h7 published

## References

- [https://github.com/wasm3/wasm3/issues/485](https://github.com/wasm3/wasm3/issues/485)
- [https://github.com/pypa/advisory-database/tree/main/vulns/pywasm3/PYSEC-2024-308.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/pywasm3/PYSEC-2024-308.yaml)
- [https://github.com/wasm3/pywasm3/blob/main/wasm3/m3_compile.c](https://github.com/wasm3/pywasm3/blob/main/wasm3/m3_compile.c)

## Related threats

- [wasm3 and pywasm3 out-of-bounds write in MarkSlotAllocated](https://junglewise.ai/threats/cve-2025-6272-wasm3-and-pywasm3-out-of-bounds-write-in-markslotallocated)
- [wasm3 pywasm3 use-after-free in ForEachModule](https://junglewise.ai/threats/cve-2024-27530-wasm3-pywasm3-use-after-free-in-foreachmodule)
- [wasm3 pywasm3 out-of-bounds read in m3_exec.h](https://junglewise.ai/threats/cve-2024-27528-wasm3-pywasm3-out-of-bounds-read-in-m3-exec-h)
- [Wasm3 uncontrolled memory allocation in Read_utf8](https://junglewise.ai/threats/cve-2024-27529-wasm3-uncontrolled-memory-allocation-in-read-utf8)
- [PYSEC-2024-303 - wasm3 139076a is vulnerable to Denial of Service (DoS).](https://junglewise.ai/threats/cve-2024-27527-pysec-2024-303-wasm3-139076a-is-vulnerable-to-denial-of-service)