Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical vulnerabilities have been discovered in Wasmtime, a widely-used WebAssembly runtime that can be embedded in other software. These flaws could allow a malicious WebAssembly module to escape the sandbox designed to isolate and contain it. An attacker would need to control a module compiled by a vulnerable Wasmtime build to exploit these issues. One of the two flaws is specific to ARM64 architecture systems. The Wasmtime project maintainers have acknowledged the vulnerabilities and released fixed versions to address them. The severity is considered critical due to the sandbox escape nature, which undermines a core security guarantee of the WebAssembly runtime model. Organizations using Wasmtime in their software stack, especially on ARM64, are advised to update immediately.