CVE-2026-34987: CWE-125: Out-of-bounds Read in bytecodealliance wasmtime
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
AI Analysis
Technical Summary
Wasmtime, a WebAssembly runtime, contains a critical out-of-bounds read vulnerability (CVE-2026-34987) in its Winch compiler backend used between versions 25.0.0 and before 36.0.7, 42.0.2, and 43.0.1. This vulnerability allows a guest Wasm module to access host memory outside its linear-memory sandbox due to an incorrect assumption about clearing upper bits of a 32-bit memory offset stored in a 64-bit register. The flaw can lead to memory disclosure, process crashes, or potentially arbitrary code execution if writes are possible. The vulnerability affects both aarch64 and x86-64 architectures, with a working proof of concept on aarch64. The default Cranelift backend is not affected. Fixes are available in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1.
Potential Impact
Exploitation of this vulnerability can allow a malicious WebAssembly guest module compiled with the Winch backend to read or write memory outside its allocated sandbox in the host process. This can result in arbitrary data leakage from the host process memory, denial of service via segmentation faults, or potentially remote code execution if write capabilities are exploited. The vulnerability is critical with a CVSS 4.0 score of 9, indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to one of these versions or later to remediate the issue. The vulnerability only affects the Winch compiler backend, which is not the default; using the default Cranelift backend avoids exposure. Patch status is not explicitly confirmed in the provided data, so users should consult the official vendor advisory for the most current remediation guidance.
CVE-2026-34987: CWE-125: Out-of-bounds Read in bytecodealliance wasmtime
Description
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wasmtime, a WebAssembly runtime, contains a critical out-of-bounds read vulnerability (CVE-2026-34987) in its Winch compiler backend used between versions 25.0.0 and before 36.0.7, 42.0.2, and 43.0.1. This vulnerability allows a guest Wasm module to access host memory outside its linear-memory sandbox due to an incorrect assumption about clearing upper bits of a 32-bit memory offset stored in a 64-bit register. The flaw can lead to memory disclosure, process crashes, or potentially arbitrary code execution if writes are possible. The vulnerability affects both aarch64 and x86-64 architectures, with a working proof of concept on aarch64. The default Cranelift backend is not affected. Fixes are available in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1.
Potential Impact
Exploitation of this vulnerability can allow a malicious WebAssembly guest module compiled with the Winch backend to read or write memory outside its allocated sandbox in the host process. This can result in arbitrary data leakage from the host process memory, denial of service via segmentation faults, or potentially remote code execution if write capabilities are exploited. The vulnerability is critical with a CVSS 4.0 score of 9, indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
This vulnerability is fixed in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to one of these versions or later to remediate the issue. The vulnerability only affects the Winch compiler backend, which is not the default; using the default Cranelift backend avoids exposure. Patch status is not explicitly confirmed in the provided data, so users should consult the official vendor advisory for the most current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-31T19:38:31.617Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d7f88c1cc7ad14da0c1706
Added to database: 4/9/2026, 7:05:48 PM
Last enriched: 4/17/2026, 12:25:08 PM
Last updated: 5/25/2026, 12:16:18 AM
Views: 128
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.