LiveActive security incident?Get immediate response
CVE Record

CVE-2021-39216: Use after free passing `externref`s to Wasm in Wasmtime

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. The bug has been fixed, and users should upgrade to Wasmtime 0.30.0. If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to `wasmtime::Config::wasm_reference_types`.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-39216 is a Wasmtime memory safety flaw affecting versions 0.19.0 through before 0.30.0. It only applies when host code passes multiple externref values to WebAssembly at the same time. The vendor says externref use was rare, reducing typical exposure, but affected deployments should upgrade or disable reference types.

Executive priority

Moderate priority. This is not broadly exploitable based on the sources, but it can affect systems that run Wasm with specific host integration patterns. Patch affected Wasmtime dependencies during the next dependency update cycle, faster for untrusted Wasm platforms.

Technical view

The issue is a CWE-416 use-after-free in Wasmtime externref handling. If VMExternRefActivationsTable filled after the first externref, passing a second externref could trigger garbage collection before the first was rooted, allowing guest Wasm to later access freed memory. CVSS is 6.3 with local attack vector, high complexity, and high integrity and availability impact.

Likely exposure

Exposure is limited to applications embedding Wasmtime 0.19.0 to 0.29.0 and using reference types with host interfaces that pass or return multiple externrefs into Wasm simultaneously. Deployments without those host-code shapes are described by the advisory as not impacted.

Exploitation context

The provided sources do not report active exploitation, and the CVE is not marked KEV. Triggering requires a specific embedding pattern and garbage collection timing. Treat untrusted Wasm execution environments using affected Wasmtime and externref host APIs as the highest-priority review targets.

Researcher notes

Focus review on Wasmtime embedders using externref and reference types. The key condition is multiple externrefs crossing from host to guest before control enters Wasm, with garbage collection occurring between them. The advisory explicitly limits impact when host code lacks those shapes.

Mitigation direction

  • Upgrade Wasmtime to version 0.30.0 or later.
  • If upgrade is blocked, disable Wasmtime reference types support.
  • Review Fedora or distribution advisories for packaged Wasmtime updates.
  • Prioritize environments that run untrusted Wasm with host externref interfaces.

Validation and detection

  • Inventory applications and services embedding Wasmtime.
  • Confirm deployed Wasmtime versions are not 0.19.0 through 0.29.0.
  • Review host interfaces for multiple externref arguments or multi-value externref returns.
  • Verify reference types are disabled where upgrade is not yet complete.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-39216 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H15.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-39216Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
bytecodealliancewasmtime>=0.19.0, <=0.29.0Listed
Weakness

CWE details

CWE-416

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs