CVE-2026-34987

Name of the Vulnerable Software and Affected Versions Wasmtime versions 25.0.0 through 36.0.6, 42.0.2, and 43.0.1

Description Wasmtime, a runtime for WebAssembly, may allow guest WebAssembly code to access host memory outside of its designated sandbox when using the Winch compiler backend. This occurs due to an incorrect assumption in the Winch compiler regarding memory offsets, potentially allowing access to memory before or after the linear-memory region. This could lead to a denial-of-service (DoS) condition, data leakage, or potentially remote code execution (RCE). The aarch64 case has a working proof of concept, while the x86-64 case is theoretical.

Recommendations Update to Wasmtime version 36.0.7, 42.0.2, or 43.0.1.