PT-2026-31687 · Bytecode Alliance · Wasmtime

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-34946

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions 25.0.0 through 36.0.6, 42.0.2, and 43.0.1

Description Wasmtime, a runtime for WebAssembly, contains an issue where the compilation of the table.fill instruction using the Winch compiler can lead to a host panic. A valid guest compiled with Winch can trigger this panic, resulting in a denial-of-service condition. The root cause is a refactoring that altered how compiled code references tables within table.* instructions, but the Winch code paths were not updated accordingly, leading to an incorrect indexing scheme. This can cause tables to be mixed up or nonexistent tables to be used, ultimately resulting in a host panic.

Recommendations Update to Wasmtime version 36.0.7, 42.0.2, or 43.0.1.

Fix

Weakness Enumeration

CWE-670

CWE-248

Related Identifiers

CVE-2026-34946

GHSA-Q49F-XG75-M9XW

RUSTSEC-2026-0089

Affected Products

Wasmtime

References · 14

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34946 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34946 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34946 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34946 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34946 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34946 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q49f-xg75-m9xw · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://rustsec.org/advisories/RUSTSEC-2026-0089.html · Note
• https://twitter.com/infoflowcloud/status/2042340926723334456 · Twitter Post
• https://crates.io/crates/wasmtime · Note
• https://twitter.com/CVEnew/status/2042340085631259135 · Twitter Post