WebAssembly Runtime Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-34941

6.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
9 April 2026

What is CVE-2026-34941?

Wasmtime, a runtime for WebAssembly, contains a vulnerability that affects its ability to correctly validate the byte length of UTF-16 strings during transcoding. This issue arises due to incorrect checks, where the number of code units is validated instead of the actual byte length, leading to potential read operations beyond the allocated linear memory. Such out-of-bounds reads can cause the host to access unmapped memory, resulting in a crash. When configured without guard pages, this vulnerability risks interpreting memory beyond the linear bounds as UTF-16, raising further security concerns. The issue is resolved in versions 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Affected Version(s)

wasmtime < 24.0.7 < 24.0.7

wasmtime >= 25.0.0, < 36.0.7 < 25.0.0, 36.0.7

wasmtime >= 37.0.0, < 42.0.2 < 37.0.0, 42.0.2

References

https://github.com/bytecodealliance/wasmtime/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.