Read the docs
TI-2026-27166 Aliases CVE-2026-34942GHSA-jxhv-7h78-9775

Wasmtime panics when transcoding misaligned utf-16 strings

Priority LOW 27CWE-129Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 24.0.7, 36.0.7, 42.0.2 +1wasmtime (crates.io): 24.0.7, 36.0.7, 42.0.2 +1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtimebefore 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.124.0.7, 36.0.7, 42.0.2, 44.0.1Patch availableCNA
—wasmtime (crates.io)before 24.0.724.0.7Patch availableGHSA-jxhv-7h78-9775
—wasmtime (crates.io)25.0.0 to before 36.0.736.0.7Patch availableGHSA-jxhv-7h78-9775
—wasmtime (crates.io)37.0.0 to before 42.0.242.0.2Patch availableGHSA-jxhv-7h78-9775
—wasmtime (crates.io)43.0.0 to before 43.0.143.0.1Patch availableGHSA-jxhv-7h78-9775
  • wasmtime Vendorbytecodealliance Affected before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.1 Fixed in 24.0.7, 36.0.7, 42.0.2, 44.0.1 Patch available CNA
  • wasmtime (crates.io) Vendor— Affected before 24.0.7 Fixed in 24.0.7 Patch available GHSA-jxhv-7h78-9775
  • wasmtime (crates.io) Vendor— Affected 25.0.0 to before 36.0.7 Fixed in 36.0.7 Patch available GHSA-jxhv-7h78-9775
  • wasmtime (crates.io) Vendor— Affected 37.0.0 to before 42.0.2 Fixed in 42.0.2 Patch available GHSA-jxhv-7h78-9775
  • wasmtime (crates.io) Vendor— Affected 43.0.0 to before 43.0.1 Fixed in 43.0.1 Patch available GHSA-jxhv-7h78-9775

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions before 24.0.7; 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 24.0.7, 36.0.7, 42.0.2, 44.0.1
  • Fix · GHSA-jxhv-7h78-9775 wasmtime (crates.io) Fixed in 24.0.7 Advisory →
  • Fix · GHSA-jxhv-7h78-9775 wasmtime (crates.io) Fixed in 36.0.7 Advisory →
  • Fix · GHSA-jxhv-7h78-9775 wasmtime (crates.io) Fixed in 42.0.2 Advisory →
  • Fix · GHSA-jxhv-7h78-9775 wasmtime (crates.io) Fixed in 43.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34942
  2. 2026-10-03 Alias added: GHSA-jxhv-7h78-9775

References

Advisory 2

Other 2

  • TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
  • TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
  • TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
  • TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
  • TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences