Every CVE Search/ Get API key

CVE-2026-34942

Wasmtime panics when transcoding misaligned utf-16 strings

5.9 MediumFix available

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Up 0.4 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Wasmtime panics when transcoding misaligned utf-16 strings

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34942
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Weakness
CWE-129
Updated
2026-11-02
EUVDEUVD-2026-20990 5.9

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
EUVD-2026-20990
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-jxhv-7h78-9775 5.9

Wasmtime: Panic when transcoding misaligned utf-16 strings

Impact

Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Record
GHSA-jxhv-7h78-9775
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-129
Updated
2026-11-02
NVD 5.9

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34942
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV 5.9

Wasmtime panics when transcoding misaligned utf-16 strings

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34942
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Weakness
CWE-129
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34942 6.5

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
DEBIAN-CVE-2026-34942
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-jxhv-7h78-9775 5.9

Wasmtime: Panic when transcoding misaligned utf-16 strings

Impact

Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Record
GHSA-jxhv-7h78-9775
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-119, CWE-129
Updated
2026-11-02
OSVJLSEC-2026-1355 5.9

Wasmtime: Panic when transcoding misaligned utf-16 strings

Impact

Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Record
JLSEC-2026-1355
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRUSTSEC-2026-0092 5.9

Panic when transcoding misaligned component model UTF-16 strings

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775 For more information see the GitHub-hosted security advisory.

Record
RUSTSEC-2026-0092
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34942 5.9

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Record
UBUNTU-CVE-2026-34942
CVSS 4.0
5.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:12355-1 No score

zed-1.24.2-1.1 on GA media

These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12355-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20749-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
openSUSE-SU-2026:20749-1
Updated
2026-11-02
OSVSUSE-SU-2026:21789-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
SUSE-SU-2026:21789-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wasmtime
crates.io
 before 24.0.7
24.0.7
wasmtime
crates.io
 25.0.0 up to 36.0.7
36.0.7
wasmtime
crates.io
 37.0.0 up to 42.0.2
42.0.2
wasmtime
crates.io
 43.0.0 to 43.0.0
43.0.1
rust-wasmtime
Debian:13
 All versions, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 38 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.11+dfsg-136.0.12+dfsg-136.0.12+dfsg-236.0.12+dfsg-336.0.13+dfsg-136.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-736.0.7+dfsg-136.0.8+dfsg-136.0.9+dfsg-136.0.9+dfsg-2
 None known
rust-wasmtime
Debian:14
 before 36.0.7+dfsg-1, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 29 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-7
36.0.7+dfsg-1
wasmtime
crates.io
 43.0.0 up to 43.0.1
43.0.1
Wasmtime_jll
Julia
 before 45.0.1+0
45.0.1+0
wasmtime
crates.io
 0.0.0-0 up to 24.0.7, 25.0.0 up to 36.0.7, 37.0.0 up to 42.0.2, 43.0.0 up to 43.0.1
24.0.736.0.742.0.243.0.1
rust-wasmtime
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
rust-wasmtime
Ubuntu:25.10
 All versions, plus listed versions
26.0.1+dfsg-3
 None known
rust-wasmtime
Ubuntu:26.10
 All versions, plus listed versions
36.0.5+dfsg-136.0.13+dfsg-1
 None known
rust-wasmtime
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1
 None known
zed
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.24.2-1.1
1.24.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34942 is a medium vulnerability (CVSS 5.9) in Bytecodealliance Wasmtime, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in wasmtime 24.0.7.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open