Wasmtime development team reports:
- Wasmtime component async-lifted callback result count is
unvalidated, causing a native stack buffer overflow.
- Mis-typed WebAssembly tag imports can lead to GC heap
corruption.
- Rooting for GC values live across try_call may be missing,
causing GC heap corruption.
- Excessive allocated memory on the host when guests don't
have stdio.
- Guest can panic host through filesystem timestamp before the
epoch on wasip3.
- Wasmtime wasi:http implementation panics with a zero timeout
supplied.
- WASI preview 0 implementation of poll_oneoff circumvents fuel
consumption.
- fd_readdir copies uninitialized struct padding into guest
memory.