Read the docs
TI-2026-27170 Aliases CVE-2026-34946GHSA-q49f-xg75-m9xw

Wasmtime's host panics when Winch compiler executes `table.fill`

Priority LOW 27CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability in Wasmtime due to guests being able to trigger a panic. The specific issue is that a historical refactoring changed how compiled code referenced tables within the table.* instructions. This refactoring forgot to update the Winch code paths associated as well, meaning that Winch was using the wrong indexing scheme. Due to the feature support of Winch the only problem that can result is tables being mixed up or nonexistent tables being used, meaning that the guest is limited to panicking the host (using a nonexistent table), or executing spec-incorrect behavior and modifying the wrong table. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 36.0.7, 42.0.2, 44.0.1wasmtime (crates.io): 36.0.7, 42.0.2, 43.0.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtime25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.136.0.7, 42.0.2, 44.0.1Patch availableCNA
—wasmtime (crates.io)25.0.0 to before 36.0.736.0.7Patch availableGHSA-q49f-xg75-m9xw
—wasmtime (crates.io)37.0.0 to before 42.0.242.0.2Patch availableGHSA-q49f-xg75-m9xw
—wasmtime (crates.io)43.0.0 to before 43.0.143.0.1Patch availableGHSA-q49f-xg75-m9xw
  • wasmtime Vendorbytecodealliance Affected 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 44.0.1 Fixed in 36.0.7, 42.0.2, 44.0.1 Patch available CNA
  • wasmtime (crates.io) Vendor— Affected 25.0.0 to before 36.0.7 Fixed in 36.0.7 Patch available GHSA-q49f-xg75-m9xw
  • wasmtime (crates.io) Vendor— Affected 37.0.0 to before 42.0.2 Fixed in 42.0.2 Patch available GHSA-q49f-xg75-m9xw
  • wasmtime (crates.io) Vendor— Affected 43.0.0 to before 43.0.1 Fixed in 43.0.1 Patch available GHSA-q49f-xg75-m9xw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions 25.0.0 to before 36.0.7; 37.0.0 to before 42.0.2; 43.0.0 to before 43.0.1 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.7, 42.0.2, 44.0.1
  • Fix · GHSA-q49f-xg75-m9xw wasmtime (crates.io) Fixed in 36.0.7 Advisory →
  • Fix · GHSA-q49f-xg75-m9xw wasmtime (crates.io) Fixed in 42.0.2 Advisory →
  • Fix · GHSA-q49f-xg75-m9xw wasmtime (crates.io) Fixed in 43.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34946
  2. 2026-10-03 Alias added: GHSA-q49f-xg75-m9xw

References

Advisory 2

Other 2

  • TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
  • TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
  • TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
  • TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
  • TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences