CVE-2026-34941
Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-34941- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-20988
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
EUVD-2026-20988- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hx6p-xpx3-jvvv
Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Summary
Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.
This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.
A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.
Impact
This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.
- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. Workarounds
There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
- Record
GHSA-hx6p-xpx3-jvvv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-34941- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-34941- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34941
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
DEBIAN-CVE-2026-34941- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVGHSA-hx6p-xpx3-jvvv
Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Summary
Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.
This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.
A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.
Impact
This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.
- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. Workarounds
There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
- Record
GHSA-hx6p-xpx3-jvvv- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVJLSEC-2026-1354
Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
Summary
Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units.
This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16.
A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled.
Impact
This is an out-of-bounds memory access. Any user running untrusted wasm components that use cross-component string passing (with UTF-16 source and latin1+utf16 destination encodings) is affected.
- With guard pages: Denial of service. The host process crashes with SIGBUS/SIGSEGV.
- Without guard pages: Potential information disclosure. The guest can read host memory beyond its linear memory allocation.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. Workarounds
There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.
- Record
JLSEC-2026-1354- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVRUSTSEC-2026-0093
Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv For more information see the GitHub-hosted security advisory.
- Record
RUSTSEC-2026-0093- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34941
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
UBUNTU-CVE-2026-34941- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10715-1 No score
libtree-sitter0_26-0.26.8-2.1 on GA media
These are all security issues fixed in the libtree-sitter0_26-0.26.8-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10715-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12355-1 No score
zed-1.24.2-1.1 on GA media
These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12355-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20749-1 No score
Security update for tree-sitter
This update for tree-sitter fixes the following issues
Security issues:
- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
- CVE-2026-34943: wasmtime: lifting
flagscomponent value can lead to a denial of service (bsc#1261954). - CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).
Changes for tree-sitter:
- update to 0.26.8:
- fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
- fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
- fix(cli): correct typo in parse command's help text by @WillLillis in #5465
- perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
- Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
- generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
- Record
openSUSE-SU-2026:20749-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21789-1 No score
Security update for tree-sitter
This update for tree-sitter fixes the following issues
Security issues:
- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
- CVE-2026-34943: wasmtime: lifting
flagscomponent value can lead to a denial of service (bsc#1261954). - CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).
Changes for tree-sitter:
- update to 0.26.8:
- fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
- fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
- fix(cli): correct typo in parse command's help text by @WillLillis in #5465
- perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
- Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
- generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
- Record
SUSE-SU-2026:21789-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wasmtimecrates.io |
before 24.0.7 | 24.0.7 |
wasmtimecrates.io |
25.0.0 up to 36.0.7 | 36.0.7 |
wasmtimecrates.io |
37.0.0 up to 42.0.2 | 42.0.2 |
wasmtimecrates.io |
43.0.0 to 43.0.0 | 43.0.1 |
rust-wasmtimeDebian:13 |
All versions, plus listed versions 26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6 Show 38 moreShow less26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.11+dfsg-136.0.12+dfsg-136.0.12+dfsg-236.0.12+dfsg-336.0.13+dfsg-136.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-736.0.7+dfsg-136.0.8+dfsg-136.0.9+dfsg-136.0.9+dfsg-2 |
None known |
rust-wasmtimeDebian:14 |
before 36.0.7+dfsg-1, plus listed versions 26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6 Show 29 moreShow less26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-7 |
36.0.7+dfsg-1 |
wasmtimecrates.io |
43.0.0 up to 43.0.1 | 43.0.1 |
Wasmtime_jllJulia |
before 45.0.1+0 | 45.0.1+0 |
wasmtimecrates.io |
0.0.0-0 up to 24.0.7, 25.0.0 up to 36.0.7, 37.0.0 up to 42.0.2, 43.0.0 up to 43.0.1 | 24.0.736.0.742.0.243.0.1 |
rust-wasmtimeUbuntu:24.04:LTS |
All versions, plus listed versions 10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rust-wasmtimeUbuntu:25.10 |
All versions, plus listed versions 26.0.1+dfsg-3 |
None known |
rust-wasmtimeUbuntu:26.10 |
All versions, plus listed versions 36.0.5+dfsg-136.0.13+dfsg-1 |
None known |
rust-wasmtimeUbuntu:26.04:LTS |
All versions, plus listed versions 26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1 |
None known |
tree-sitteropenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.26.8-2.1 | 0.26.8-2.1 |
zedopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 1.24.2-1.1 | 1.24.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34941 is a medium vulnerability (CVSS 6.9) in Bytecodealliance Wasmtime, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in wasmtime 24.0.7.
References
github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv
nvd.nist.gov/vuln/detail/CVE-2026-34941
rustsec.org/advisories/RUSTSEC-2026-0093.html
security-tracker.debian.org/tracker/CVE-2026-34941
Show 37 moreShow less
crates.io/crates/wasmtime
suse.com/support/update/announcement/2026/suse-su-202621789-1
bugzilla.suse.com/1259205
ubuntu.com/security/CVE-2026-34941
cve.org/CVERecord?id=CVE-2026-34941