{"id":"CVE-2022-39394","summary":"wasmtime_trap_code C API function has out of bounds write vulnerability","details":"Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the definition of the `wasmtime_trap_code` does not match its declared signature in the `wasmtime/trap.h` header file. This discrepancy causes the function implementation to perform a 4-byte write into a 1-byte buffer provided by the caller. This can lead to three zero bytes being written beyond the 1-byte location provided by the caller. This bug has been patched and users should upgrade to Wasmtime 2.0.2. This bug can be worked around by providing a 4-byte buffer casted to a 1-byte buffer when calling `wasmtime_trap_code`. Users of the `wasmtime` crate are not affected by this issue, only users of the C API function `wasmtime_trap_code` are affected.","aliases":["GHSA-h84q-m8rr-3v9q","RUSTSEC-2022-0097"],"modified":"2026-08-12T03:51:10.487915368Z","published":"2022-11-10T00:00:00Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39394.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39394.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h84q-m8rr-3v9q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39394"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bytecodealliance/wasmtime","events":[{"introduced":"0"},{"fixed":"15991947f485a60298e45d1d915125c0f3cc5a8a"},{"introduced":"ff8c568eeed3918a5d591295e9384e2b1e462aae"},{"fixed":"a528e0383e1177119a6c985dac1972513df11a03"},{"fixed":"087d9d7becf7422b3f872a3bcd5d97bb7ce7ff36"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.0.2"},{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}}],"versions":["v1.0.1","v2.0.1","v2.0.0","v1.0.0","v0.35.0","v0.33.0","v0.34.0","v0.32.0","v0.31.0","v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","cranelift-v0.69.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","cranelift-v0.61.0","cranelift-v0.60.0","v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39394.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"}]}