CVE-2023-41880 — Off-by-one Error in Wasmtime

CWE-193 — Off-by-one Error7 documents5 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 57.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Bytecodealliance WasmtimeDebian Rust-wasmtime
Timeline
PublishedSep 15
Latest updateFeb 20

Description

Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 to versions 10.02, 11.0.2, and 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the l…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDbytecodealliance/wasmtime10.0.0 — 10.0.2+2
▶crates.iobytecodealliance/wasmtime0.0.0-0 — 10.0.2+3
▶CVEListV5bytecodealliance/wasmtime>= 10.0.0, < 10.0.2, >= 11.0.0, < 11.0.2, >= 12.0.0, < 12.0.2+2
▶debiandebian/rust-wasmtime< rust-wasmtime 15.0.0+dfsg-1 (forky)

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
CVE-2023-41880: Wasmtime is a standalone runtime for WebAssembly↗2023-09-15
▶
GHSA
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64↗2023-09-14
▶
OSV
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64↗2023-09-14
▶
OSV
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64↗2023-09-05
▶

📋Vendor Advisories

1
Debian
CVE-2023-41880: rust-wasmtime - Wasmtime is a standalone runtime for WebAssembly. Wasmtime versions from 10.0.0 ...↗2023
▶

📄Research Papers

1
arXiv
AndroWasm: an Empirical Study on Android Malware Obfuscation through WebAssembly↗2026-02-20
▶