RUSTSEC-2026-0422

Typed functions with i31 or nullref arguments may panic due to insufficient type-check

Reported

October 29, 2026

Issued

October 30, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-3982-jqvv-277m

References

https://github.com/bytecodealliance/wasmtime/pull/15076

CVSS Score

1.8 LOW

CVSS Details

Attack Vector: Adjacent
Attack Complexity: High
Privileges Required: High
User Interaction: Required
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L

Patched

>=48.0.8, <49.0.0
>=49.0.5, <50.0.0
>=50.0.1

Unaffected

<47.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.