RUSTSEC-2026-0090

Use-after-free bug after cloning wasmtime::Linker

Reported

April 9, 2026

Issued

April 9, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

References

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2

CVSS Score

1 LOW

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Physical
Privileges Required: High
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Active
Availability Impact to the Vulnerable System: Low
Confidentiality Impact to the Vulnerable System: Low
Integrity Impact to the Vulnerable System: Low

CVSS Vector

CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Patched

>=43.0.1

Unaffected

<43.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.