Read the docs
TI-2026-27169 Aliases CVE-2026-34945GHSA-m9w2-8782-2946

Wasmtime leaks host data with 64-bit tables and Winch

Priority LOW 12CWE-681Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 36.0.7, 42.0.2, 44.0.1wasmtime (crates.io): 36.0.7, 42.0.2, 43.0.1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtime25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.136.0.7, 42.0.2, 44.0.1Patch availableCNA
—wasmtime (crates.io)25.0.0 to before 36.0.736.0.7Patch availableGHSA-m9w2-8782-2946
—wasmtime (crates.io)37.0.0 to before 42.0.242.0.2Patch availableGHSA-m9w2-8782-2946
—wasmtime (crates.io)43.0.0 to before 43.0.143.0.1Patch availableGHSA-m9w2-8782-2946
  • wasmtime Vendorbytecodealliance Affected 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.1 Fixed in 36.0.7, 42.0.2, 44.0.1 Patch available CNA
  • wasmtime (crates.io) Vendor— Affected 25.0.0 to before 36.0.7 Fixed in 36.0.7 Patch available GHSA-m9w2-8782-2946
  • wasmtime (crates.io) Vendor— Affected 37.0.0 to before 42.0.2 Fixed in 42.0.2 Patch available GHSA-m9w2-8782-2946
  • wasmtime (crates.io) Vendor— Affected 43.0.0 to before 43.0.1 Fixed in 43.0.1 Patch available GHSA-m9w2-8782-2946

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.7, 42.0.2, 44.0.1
  • Fix · GHSA-m9w2-8782-2946 wasmtime (crates.io) Fixed in 36.0.7 Advisory →
  • Fix · GHSA-m9w2-8782-2946 wasmtime (crates.io) Fixed in 42.0.2 Advisory →
  • Fix · GHSA-m9w2-8782-2946 wasmtime (crates.io) Fixed in 43.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34945
  2. 2026-10-03 Alias added: GHSA-m9w2-8782-2946

References

Advisory 2

Other 2

  • TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
  • TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
  • TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
  • TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
  • TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences