Wasmtime is a WebAssembly runtime that supports multiple compiler backends, including Cranelift (default) and Winch (non-default). CVE-2026-34987 is an out-of-bounds read vulnerability in Wasmtime's Winch backend present in versions >=25.0.0 and <36.0.7, >=37.0.0 and <42.0.2, and >=43.0.0 and <44.0.1. The vulnerability allows a guest Wasm module compiled with Winch to access host memory outside its linear-memory sandbox due to improper handling of 32-bit offsets stored in 64-bit registers. This can lead to reading memory before or after the linear memory region, with a proof-of-concept demonstrated on aarch64 and theoretical impact on x86-64. Potential impacts include host process crashes (DoS), arbitrary data leaks, or remote code execution if writes are possible. The issue is resolved in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1.

Exploitation of this vulnerability can allow a WebAssembly guest using the Winch compiler backend to read or potentially write outside its allocated memory sandbox. This can cause segmentation faults resulting in denial of service, leak sensitive host process memory, or lead to arbitrary remote code execution. The vulnerability is critical with a CVSS 4.0 score of 9.0, reflecting network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to one of these versions or later to remediate this vulnerability. Since the vulnerability only affects the Winch compiler backend, avoiding use of this backend or using the default Cranelift backend can mitigate risk. Patch status is confirmed by the version ranges fixed. No vendor advisory content contradicts this guidance.