CVE-2022-39392

CVE-2022-39392 is a high-severity vulnerability affecting Wasmtime, a WebAssembly runtime, specifically versions prior to 2.0.2. The flaw arises when Wasmtime's pooling instance allocator is configured to provide zero pages of memory, leading to improper virtual memory mappings that allow out-of-bounds reads/writes to memory outside the WebAssembly sandbox. This can result in high impact to confidentiality and integrity, with a CVSS score of 7.4 (High). While the vulnerability requires a rare, non-default configuration, there is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion.