What is the CVSS score of CVE-2024-30266?

CVE-2024-30266 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2024-30266?

Yes, a public proof-of-concept exploit is available for CVE-2024-30266. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2024-30266?

Yes, a patch is available for CVE-2024-30266. Update the affected software to the latest version immediately.

Wasmtime CVE-2024-30266

MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2024-04-04 security-advisories@github.com

Information Disclosure Memory Corruption Wasmtime

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Apr 04, 2024 - 16:15 nvd

MEDIUM 5.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 pypi packages depend on wasmtime (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 19.0.0.

DescriptionNVD

wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1.

AnalysisAI

wasmtime is a runtime for WebAssembly. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Access of Resource Using Incompatible Type (Type Confusion) (CWE-843), which allows attackers to execute arbitrary code by exploiting type confusion in the application. wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This vulnerability has been patched in version 19.0.1. Affected products include: Bytecodealliance Wasmtime. Version information: version 19.0.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Enforce strict type checking, use type-safe languages, validate object types before operations.