CVE intelligence and bounded remediation

CVE-2023-26489 — wasmtime is a fast and secure runtime for WebAssembly

Critical CVSS 9.9

wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Due to this bug, however, addresses up to `0xffffffff * 8 + 0x7ffffffc = 36507222004 = ~34G` bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modu…

Severity
Critical
CVSS
9.9 (3.1)
Published
2023-03-08
CISA KEV
Not currently listed
Ecosystem
software/application
Weaknesses
CWE-125, CWE-787

Affected products

  • bytecodealliance / cranelift-codegen
  • bytecodealliance / cranelift-codegen / 0.92.0
  • bytecodealliance / cranelift-codegen / 0.93.0
  • bytecodealliance / wasmtime
  • bytecodealliance / wasmtime / 5.0.0
  • bytecodealliance / wasmtime / 6.0.0

Matched remediation archetype

Buffer bounds, memory safety, and memory corruption

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Identify affected native-code versions, build flags, architectures, parsers, codecs, drivers, and input paths in all shipped artifacts.
  • Determine whether untrusted data reaches the affected routine and the process privilege, sandbox, and network exposure.
  • Confirm statically linked, vendored, firmware, and platform-provided copies, not only package-manager records.

Remediate safely

  • Apply the maintained upstream correction or replace the affected component, then rebuild every dependent artifact from clean inputs.
  • Adopt bounds-checked interfaces, validated sizes and integer conversions, clear ownership, and memory-safe components where practical.
  • Enable supported compiler and runtime hardening and add sanitized tests and fuzz regression seeds derived from non-weaponized fixtures.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.