OR
     *cpe:2.3:a:bytecodealliance:cranelift-codegen:*:*:*:*:*:rust:*:* versions from (including) 0.84.0 up to (excluding) 0.85.2
     *cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* versions from (including) 0.37.0 up to (excluding) 0.38.2

NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

https://github.com/WebAssembly/reference-types No Types Assigned

https://github.com/WebAssembly/reference-types Third Party Advisory

https://github.com/bytecodealliance/wasmtime/ No Types Assigned

https://github.com/bytecodealliance/wasmtime/ Product, Third Party Advisory

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g No Types Assigned

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5fhj-g3p3-pq9g Mitigation, Third Party Advisory

There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd, leading later to a use-after-free. This bug was 

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will mistakenly think these functions do not have live references to GC'd values, reclaiming them and deallocating them. The function will then subsequently continue to use the values assuming they had not been GC'd