WebAssembly Runtime Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-34942

5.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
9 April 2026

What is CVE-2026-34942?

Wasmtime, a WebAssembly runtime, has a vulnerability in its string transcoding implementation that fails to properly verify the alignment of reallocated strings. This flaw allows malicious guests to send crafted strings across components, potentially leading to host panics, which represent a Denial of Service (DoS) risk. The issue is resolved in versions 24.0.7, 36.0.7, 42.0.2, and 43.0.1. Organizations utilizing Wasmtime are advised to upgrade to these versions to mitigate the risk.

Affected Version(s)

wasmtime < 24.0.7 < 24.0.7

wasmtime >= 25.0.0, < 36.0.7 < 25.0.0, 36.0.7

wasmtime >= 37.0.0, < 42.0.2 < 37.0.0, 42.0.2

References

https://github.com/bytecodealliance/wasmtime/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.