Every CVE Search/ Get API key

CVE-2026-34945

Wasmtime leaks host data with 64-bit tables and Winch

2.3 LowFix available

CVE-2026-34945 is a low vulnerability (CVSS 2.3) in Bytecodealliance Wasmtime, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in wasmtime 36.0.7.

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Apr 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.3

Wasmtime leaks host data with 64-bit tables and Winch

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34945
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness
CWE-681
Updated
2026-11-02
EUVDEUVD-2026-21024 2.3

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
EUVD-2026-21024
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m9w2-8782-2946 2.3

Wasmtime has host data leakage with 64-bit tables and Winch

Impact

Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests.

This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This information disclosure should not be possible in WebAssembly, violates spec semantics, and is a vulnerability in Wasmtime.

Patches

Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

Users of Cranelift are not affected by this issue, but users of Winch have no workarounds other than disabling the Config::wasm_memory64 proposal.

Record
GHSA-m9w2-8782-2946
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-681
Updated
2026-11-02
NVD 2.3

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34945
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-681
Updated
2026-11-02
OSV 2.3

Wasmtime leaks host data with 64-bit tables and Winch

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
CVE-2026-34945
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness
CWE-681
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34945 6.5

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
DEBIAN-CVE-2026-34945
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-m9w2-8782-2946 2.3

Wasmtime has host data leakage with 64-bit tables and Winch

Impact

Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests.

This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This information disclosure should not be possible in WebAssembly, violates spec semantics, and is a vulnerability in Wasmtime.

Patches

Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

Users of Cranelift are not affected by this issue, but users of Winch have no workarounds other than disabling the Config::wasm_memory64 proposal.

Record
GHSA-m9w2-8782-2946
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-681
Updated
2026-11-02
OSVJLSEC-2026-1358 2.3

Wasmtime has host data leakage with 64-bit tables and Winch

Impact

Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests.

This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This information disclosure should not be possible in WebAssembly, violates spec semantics, and is a vulnerability in Wasmtime.

Patches

Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

Workarounds

Users of Cranelift are not affected by this issue, but users of Winch have no workarounds other than disabling the Config::wasm_memory64 proposal.

Record
JLSEC-2026-1358
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRUSTSEC-2026-0086 2.3

Host data leakage with 64-bit tables and Winch

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946 For more information see the GitHub-hosted security advisory.

Record
RUSTSEC-2026-0086
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34945 2.3

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Record
UBUNTU-CVE-2026-34945
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10598-1 No score

libtree-sitter0_26-0.26.8-1.1 on GA media

These are all security issues fixed in the libtree-sitter0_26-0.26.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10598-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20749-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
openSUSE-SU-2026:20749-1
Updated
2026-11-02
OSVSUSE-SU-2026:21789-1 No score

Security update for tree-sitter

This update for tree-sitter fixes the following issues

Security issues:

  • CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
  • CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
  • CVE-2026-34943: wasmtime: lifting flags component value can lead to a denial of service (bsc#1261954).
  • CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
  • CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
  • CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
  • CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
  • CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
  • CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
  • CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).

Changes for tree-sitter:

  • update to 0.26.8:
  • fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @WillLillis in #5465
  • perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
Record
SUSE-SU-2026:21789-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wasmtime
crates.io
 25.0.0 up to 36.0.7
36.0.7
wasmtime
crates.io
 37.0.0 up to 42.0.2
42.0.2
wasmtime
crates.io
 43.0.0 to 43.0.0
43.0.1
rust-wasmtime
Debian:13
 All versions, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 38 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.11+dfsg-136.0.12+dfsg-136.0.12+dfsg-236.0.12+dfsg-336.0.13+dfsg-136.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-736.0.7+dfsg-136.0.8+dfsg-136.0.9+dfsg-136.0.9+dfsg-2
 None known
rust-wasmtime
Debian:14
 before 36.0.7+dfsg-1, plus listed versions
26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6
Show 29 moreShow less
26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-7
36.0.7+dfsg-1
wasmtime
crates.io
 43.0.0 up to 43.0.1
43.0.1
Wasmtime_jll
Julia
 39.0.0+0 up to 45.0.1+0
45.0.1+0
wasmtime
crates.io
 0.0.0-0 up to 36.0.7, 37.0.0 up to 42.0.2, 43.0.0 up to 43.0.1
36.0.742.0.243.0.1
rust-wasmtime
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3
 None known
rust-wasmtime
Ubuntu:25.10
 All versions, plus listed versions
26.0.1+dfsg-3
 None known
rust-wasmtime
Ubuntu:26.10
 All versions, plus listed versions
36.0.5+dfsg-136.0.13+dfsg-1
 None known
rust-wasmtime
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1
 None known
tree-sitter
openSUSE:Tumbleweed
 before 0.26.8-1.1
0.26.8-1.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open