PT-2026-31690 · Bytecode Alliance · Wasmtime

Published 2026-04-09 · Updated 2026-04-11 · CVE-2026-34987

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions 25.0.0 through 36.0.6, 42.0.2, and 43.0.1

Description Wasmtime, a runtime for WebAssembly, may allow guest WebAssembly code to access host memory outside of its designated sandbox when using the Winch compiler backend. This occurs due to an incorrect assumption in the Winch compiler regarding memory offsets, potentially allowing access to memory before or after the linear-memory region. This could lead to a denial-of-service (DoS) condition, data leakage, or potentially remote code execution (RCE). The aarch64 case has a working proof of concept, while the x86-64 case is theoretical.

Recommendations Update to Wasmtime version 36.0.7, 42.0.2, or 43.0.1.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2026-34987

GHSA-XX5W-CVP6-JV83

RUSTSEC-2026-0095

Affected Products

Wasmtime

References · 16

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0095 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xx5w-cvp6-jv83 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34987 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34987 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34987 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34987 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34987 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://twitter.com/infoflowcloud/status/2042340825795821593 · Twitter Post
• https://crates.io/crates/wasmtime · Note
• https://twitter.com/0dayPublishing/status/2042613493048729949 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042796824264679464 · Twitter Post
• https://rustsec.org/advisories/RUSTSEC-2026-0095.html · Note