-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper tracking of reference-type values during code generation. The commit diff shows critical changes to constant loading (load_constant64_full) and immediate value handling (imm rules) in the AArch64 backend. These functions were modified to add ImmExtend parameter handling, which is crucial for maintaining GC metadata. The original vulnerable versions lacked proper sign/zero extension tracking for reference-bearing values, causing regalloc2 to incorrectly elide stack maps. The patch explicitly adds extension type handling and proper value masking, confirming these were the problematic areas.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wasmtime | rust | >= 0.37.0, < 0.38.2 | 0.38.2 |
| cranelift-codegen | rust | >= 0.84.0, < 0.85.2 | 0.85.2 |
RustRustOngoing coverage of React2Shell