CVE-2023-27477

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the WebAssembly `i8x16.select` instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one error in the calculation of the mask to the `pshufb` instruction which causes incorrect results to be returned if lanes are selected from the second vector. This codegen bug has been fixed in Wasmtiem 6.0.1, 5.0.1, and 4.0.1. Users are recommended to upgrade to these updated versions. If upgrading is not an option for you at this time, you can avoid this miscompilation by disabling the Wasm simd proposal. Additionally the bug is only present on x86_64 hosts. Other platforms such as AArch64 and s390x are not affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-193

Affected software

No affected versions have been published.

Timeline

Published
Mar 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-274786.5libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previCVE-2023-274799.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274807.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274814.3Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `CVE-2023-2748210.0homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the SupervCVE-2023-274837.5crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory paniCVE-2023-274844.9crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions CVE-2023-274854.3thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to qCVE-2023-274868.8xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanismCVE-2023-274879.1Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, andCVE-2023-274889.8Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, andCVE-2023-274895.4Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users whic