Wasmtime Ships Largest-Ever Security Patch After LLM-Driven Audit Uncovers 12 Vulnerabilities Including Two Critical Sandbox Escapes
The Bytecode Alliance patches 12 Wasmtime flaws, two critical, found during a three-week LLM-assisted security sprint by Mozilla, UCSD, Akamai, and F5.
Overview
The Bytecode Alliance on April 9 released patch versions of its Wasmtime WebAssembly runtime addressing 12 distinct security vulnerabilities, two of them rated Critical. The disclosure represents the largest batch of security advisories the project has ever published at once — triple the total number of advisories issued in all of 2025 and double the number of Critical-severity findings in the runtime’s history.
What makes the disclosure unusual is how the bugs were found: 11 of the 12 vulnerabilities were identified using LLM-based tools through a multi-agent harness developed during an intense three-week collaborative sprint among engineers from Mozilla, UCSD, Akamai, and F5.
What We Know
Patched versions — Wasmtime 43.0.1, 42.0.2, 36.0.7, and 24.0.7 — were released simultaneously on April 9. The fixes span four supported release branches, reflecting the breadth of affected code.
The two Critical-severity issues are both sandbox escapes. CVE-2026-34987 affects the Winch compiler backend and could allow a WebAssembly guest module to perform out-of-sandbox memory access. CVE-2026-34971 stems from a miscompilation of guest heap accesses in the Cranelift code generator on AArch64, a bug introduced in Wasmtime 32.0.0. Users running Cranelift on x86-64 are not affected by either Critical-severity escape.
The remaining ten vulnerabilities range from Moderate to Low severity and touch several subsystems:
- Winch compiler backend: improper masking of
table.growreturn values, host panics ontable.fill, and data leakage with 64-bit tables - Cranelift: a segfault or out-of-sandbox load triggered by the
f64x2.splatoperator on x86-64 - Component Model: out-of-bounds writes during string transcoding, panics on misaligned UTF-16 strings, heap out-of-bounds reads during UTF-16 conversion, and panics when lifting
flagsvalues - Runtime: a use-after-free in
wasmtime::Linkercloning, and data leakage between pooling allocator instances
The LLM Audit
Shun Kashiwa from UCSD developed the multi-agent harness and the LLM prompts that uncovered the majority of the issues, according to the Bytecode Alliance’s disclosure. The harness targeted Wasmtime’s most security-sensitive code paths — native code generation in the Cranelift and Winch engines, and unsafe Rust in the runtime — across different architectures and backends, then validated each potential bug by reproducing proof-of-concept exploits and test vectors.
The sprint produced 11 unique issues, with diminishing returns after the first week and no new findings after the second. Alex Crichton from Akamai led the remediation effort.
Notably, Cranelift’s instruction-lowering rules had previously been formally verified, but the formal model had not been updated to reflect changes introduced in version 32.0.0. When the team refreshed the model against the latest Cranelift lowering rules, formal verification independently flagged the same AArch64 bug that the LLM search had already surfaced — providing an independent cross-check between two different assurance techniques.
What We Don’t Know
The Bytecode Alliance has not disclosed whether any of the vulnerabilities were exploited in the wild prior to patching. The organization also has not published the LLM harness itself or detailed the specific models used, though the blog post states that the team is convinced LLM-based tools will become a permanent part of Wasmtime’s security toolbox.
It remains unclear how broadly AArch64-based Wasmtime deployments are used in production. Akamai, which acquired Fermyon in late 2025 to run WebAssembly workloads across its edge network, was among the organizations involved in the audit — suggesting that the findings may have direct implications for large-scale edge deployments.
Analysis
The scale of this disclosure underscores both a risk and an opportunity for the WebAssembly ecosystem. Wasmtime is the reference implementation of the W3C WebAssembly Component Model and the runtime underpinning several commercial edge platforms. Two sandbox escapes in a runtime whose core value proposition is safe, sandboxed execution demand serious attention from any organization running untrusted Wasm modules in production.
At the same time, the discovery method is significant. Using LLMs to systematically probe compiler backends and runtime internals — and having formal verification independently confirm one of the same bugs — points to a maturing security methodology. If the approach proves reproducible, it could set a precedent for how safety-critical open-source projects conduct security audits going forward.
The Bytecode Alliance has committed to implementing continuous LLM scanning, enhanced fuzzing for invalid inputs, dedicated AArch64 fuzzing infrastructure, and formal verification integration for Cranelift as ongoing measures.