PT-2026-31686 · Bytecode Alliance · Wasmtime

Published 2026-04-09 · Updated 2026-04-21 · CVE-2026-34945

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wasmtime versions 25.0.0 through 36.0.6, 42.0.2, and 43.0.1

Description Wasmtime's Winch compiler has a flaw in how it handles the table.size instruction with 64-bit tables, part of the WebAssembly memory64 proposal. This can lead to the disclosure of data from the host's stack to WebAssembly guests. The host stack may contain sensitive data from other operations that should not be accessible to guests. The issue stems from the table.size return value being incorrectly typed as a 32-bit integer instead of dynamically determining its size based on the table's index type. This, combined with Winch's Application Binary Interface (ABI) and multi-value returns, allows reading host stack data within a guest.

Recommendations Update to Wasmtime version 36.0.7, 42.0.2, or 43.0.1.

Fix

Information Disclosure

Weakness Enumeration

CWE-681

CWE-200

Related Identifiers

CVE-2026-34945

GHSA-M9W2-8782-2946

OPENSUSE-SU-2026:10598-1

RUSTSEC-2026-0086

Affected Products

Wasmtime

References · 16

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34945 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34945 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34945 · Security Note
• https://ubuntu.com/security/CVE-2026-34945 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m9w2-8782-2946 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0086 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34945 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10598-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34945 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://twitter.com/infoflowcloud/status/2042340876173660166 · Twitter Post
• https://crates.io/crates/wasmtime · Note
• https://suse.com/security/cve/CVE-2026-34945 · Note
• https://twitter.com/CVEnew/status/2042340086839144624 · Twitter Post