Security readout for executives and security teams
Plain-English summary
Wasmtime could mishandle WebAssembly externref values during garbage collection under narrow conditions, causing invalid frees and out-of-bounds memory access. Business risk is mainly for services embedding affected Wasmtime versions and running untrusted or tenant-supplied Wasm with host-created externrefs.
Executive priority
Treat as a targeted remediation item, not a broad emergency. Prioritize exposed Wasmtime hosts processing untrusted Wasm and using externrefs. Patch during the next controlled maintenance window unless inventory shows high-risk multi-tenant execution paths.
Technical view
In Wasmtime 0.26.0 through 0.29.0, GC safepoint stack maps could be selected incorrectly for frames with earlier live externrefs and a later empty safepoint. Bogus stack slots were rooted as externrefs, then dropped at a later GC, causing invalid free and possible out-of-bounds read/write.
Likely exposure
Exposure is limited to applications embedding Wasmtime 0.26.0-0.29.0 where Wasm uses externref, host code creates non-null externrefs, and GC occurs. Hosts not creating non-null externrefs or avoiding the reference-types path are unlikely affected based on the advisory.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not listed as KEV. The CVSS vector indicates local access, low privileges, high attack complexity, and no user interaction, with integrity and availability impact.
Researcher notes
The vulnerability depends on a specific GC safepoint mismatch involving externrefs. Sources describe invalid free plus possible out-of-bounds read/write, but do not provide public exploitation evidence. Validate exposure through version, reference-types configuration, externref host behavior, and GC usage.
Mitigation direction
- Upgrade Wasmtime to version 0.30.0 or later.
- If upgrade is delayed, disable reference types with wasm_reference_types set to false.
- Inventory applications that embed Wasmtime directly or through Rust dependencies.
- Prioritize services that execute untrusted Wasm or tenant-provided modules.
- Review Fedora package advisories where Wasmtime is consumed through Fedora packages.
Validation and detection
- Confirm deployed Wasmtime versions are not 0.26.0 through 0.29.0.
- Review host code for non-null externref creation.
- Check whether host code explicitly triggers Wasmtime garbage collection.
- Verify reference types are disabled where patching is delayed.
- Confirm SBOMs or dependency manifests reflect the patched Wasmtime version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-590: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39218 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H15.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://crates.io/crates/wasmtimeCVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4873-36h9-wv49CVE reference · x_refsource_CONFIRM
- https://github.com/bytecodealliance/wasmtime/commit/398a73f0dd862dbe703212ebae8e34036a18c11cCVE reference · x_refsource_MISC
- FEDORA-2021-68713440cbCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-1805eacb48CVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.