The Webassembly Virtual Machine Project maintains a narrowly scoped runtime implementation for WebAssembly execution, a specialized and emerging technology component with prominence across sandboxed and embedded deployment scenarios. Observed vulnerabilities in this product cluster around memory-safety and control-flow issues—including out-of-bounds reads, buffer-boundary violations, NULL-pointer dereferences, and incorrect control-flow implementation—reflecting the low-level runtime demands of bytecode interpretation and execution. Current exploitation status and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webassembly Virtual Machine Project over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-17293HIGH An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments | Sep 21, 2018 | 8.8 | 28 | NO | NO |
CVE-2018-16770HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16768HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16767HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16766HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16765HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16764HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-16769HIGH In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact becau | Sep 10, 2018 | 8.8 | 24 | NO | NO |
CVE-2018-17292MEDIUM An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attack | Sep 21, 2018 | 6.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webassembly Virtual Machine Project.
Media articles that mention a CVE ID that affects a product developed by Webassembly Virtual Machine Project — matched by CVE ID, not by vendor name.