PT-2026-31692 · Bytecode Alliance · Wasmtime

Published 2026-04-09 · Updated 2026-05-06 · CVE-2026-35186

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions 25.0.0 through 36.0.6, 42.0.2, and 43.0.1

Description Wasmtime, a runtime for WebAssembly, has an issue in its Winch compiler backend where the translation of the table.grow operator results in an incorrect type. Specifically, for 32-bit tables, the result is tagged as a 64-bit value instead of a 32-bit value within Winch. This can lead to a denial of service (DoS) by crashing the host process, a correctness issue within Winch, and a potential leak of up to 16 bytes before linear memory. The vulnerability is exploitable when guard pages before linear memory are disabled. The default compiler for Wasmtime is Cranelift, and the default configuration includes guard pages, meaning the default configuration is not affected.

Recommendations Update to Wasmtime version 36.0.7, 42.0.2, or 43.0.1.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-35186

GHSA-F984-PCP8-V2P7

OPENSUSE-SU-2026:10715-1

RUSTSEC-2026-0094

Affected Products

Wasmtime

References · 19

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f984-pcp8-v2p7 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10715-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35186 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35186 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35186 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2026-0094 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35186 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35186 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35186 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime · Note
• https://twitter.com/CVEnew/status/2042340079406907491 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042340795672367565 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34988 · Note
• https://suse.com/security/cve/CVE-2026-34941 · Note