<![CDATA[🔴 Critical: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes]]>Two critical vulnerabilities have been disclosed in Wasmtime, a WebAssembly runtime that can be embedded into other software. According to the project's maintainers, both flaws could allow a malicious WebAssembly module to break out of the sandbox that is meant to contain it.

Exploitation requires the attacker to get a vulnerable Wasmtime build to compile a module they control — the flaws are not remotely triggerable on their own. One of the two issues impacts only ARM64 systems, so exposure depends heavily on the underlying architecture in use.

Fixed versions of Wasmtime have been released, and operators running the runtime — directly or as a dependency inside another application — should upgrade to the patched release as soon as possible.

Mitigation guidance:

  • Identify any software in your environment that bundles or embeds Wasmtime.
  • Upgrade to the fixed release published by the maintainers.
  • Pay particular attention to ARM64 deployments, which are affected by one of the two flaws.
  • Avoid compiling or running untrusted WebAssembly modules on unpatched builds.

Source: The Hacker News

Does your organization embed Wasmtime in any production software, and have you already patched it?

]]>https://xploitlk.com/topic/801/critical-two-critical-wasmtime-flaws-could-let-malicious-webassembly-modules-escape-sandboxesRSS for NodeTue, 27 Oct 2026 07:23:15 GMTMon, 26 Oct 2026 14:30:18 GMT60