CVE-2026-35195
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-35195- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-21039
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
EUVD-2026-21039- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-394w-hwhg-8vgm
Wasmtime has out-of-bounds write or crash when transcoding component model strings
Impact
Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration.
Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds
There is no known workaround for this issue and affected hosts/embeddings are recommended to upgrade.
- Record
GHSA-394w-hwhg-8vgm- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-35195- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Wasmtime has an out-of-bounds write or crash when transcoding component model strings
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
CVE-2026-35195- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-35195
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
DEBIAN-CVE-2026-35195- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-394w-hwhg-8vgm
Wasmtime has out-of-bounds write or crash when transcoding component model strings
Impact
Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration.
Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds
There is no known workaround for this issue and affected hosts/embeddings are recommended to upgrade.
- Record
GHSA-394w-hwhg-8vgm- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVJLSEC-2026-1364
Wasmtime has out-of-bounds write or crash when transcoding component model strings
Impact
Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration.
Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories.
Patches
Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.
Workarounds
There is no known workaround for this issue and affected hosts/embeddings are recommended to upgrade.
- Record
JLSEC-2026-1364- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRUSTSEC-2026-0091
Out-of-bounds write or crash when transcoding component model strings
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm For more information see the GitHub-hosted security advisory.
- Record
RUSTSEC-2026-0091- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-35195
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
- Record
UBUNTU-CVE-2026-35195- CVSS 4.0
- 6.1 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20749-1 No score
Security update for tree-sitter
This update for tree-sitter fixes the following issues
Security issues:
- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
- CVE-2026-34943: wasmtime: lifting
flagscomponent value can lead to a denial of service (bsc#1261954). - CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).
Changes for tree-sitter:
- update to 0.26.8:
- fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
- fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
- fix(cli): correct typo in parse command's help text by @WillLillis in #5465
- perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
- Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
- generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
- Record
openSUSE-SU-2026:20749-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21789-1 No score
Security update for tree-sitter
This update for tree-sitter fixes the following issues
Security issues:
- CVE-2026-34941: wasmtime: crafted input string can lead to an out-of-bound read (bsc#1261871).
- CVE-2026-34942: wasmtime: unaligned pointers can lead to a denial of service (bsc#1261894).
- CVE-2026-34943: wasmtime: lifting
flagscomponent value can lead to a denial of service (bsc#1261954). - CVE-2026-34944: wasmtime: out-of-bounds read during WebAssembly compilation can lead to a denial of service (bsc#1261963).
- CVE-2026-34945: wasmtime: incorrectly translated table.size could lead to disclosing data (bsc#1262007).
- CVE-2026-34946: wasmtime: denial of service due to WebAssembly compilation error (bsc#1261974).
- CVE-2026-34987: wasmtime: winch compiler backend may allow a sandbox-escaping memory access (bsc#1262032).
- CVE-2026-34988: wasmtime: pooling allocator instances can cause data leakage (bsc#1261968).
- CVE-2026-35186: wasmtime: translating the table.grow operator can cause a masked return value (bsc#1262036).
- CVE-2026-35195: wasmtime: transcoding strings can lead to an out of bound write or a crash (bsc#1262040).
Changes for tree-sitter:
- update to 0.26.8:
- fix(generate): allow disabling qjs-rt feature from CLI by @WillLillis in #5448
- fix(lib): document invariants that must be upheld for TSInputEdit by @WillLillis in #5452
- fix(cli): correct typo in parse command's help text by @WillLillis in #5465
- perf(cli): misc. improvements by @tree-sitter-ci-bot[bot] in #5476
- Fix wasm loading of languages w/ multiple reserved word sets by @tree-sitter-ci-bot[bot] in #5477
- generate: avoid panicking when a supertype only has hidden external token children by @tree-sitter-ci-bot[bot] in #5478
- Record
SUSE-SU-2026:21789-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wasmtimecrates.io |
before 24.0.7 | 24.0.7 |
wasmtimecrates.io |
25.0.0 up to 36.0.7 | 36.0.7 |
wasmtimecrates.io |
37.0.0 up to 42.0.2 | 42.0.2 |
wasmtimecrates.io |
43.0.0 to 43.0.0 | 43.0.1 |
rust-wasmtimeDebian:13 |
All versions, plus listed versions 26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6 Show 38 moreShow less26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.11+dfsg-136.0.12+dfsg-136.0.12+dfsg-236.0.12+dfsg-336.0.13+dfsg-136.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-736.0.7+dfsg-136.0.8+dfsg-136.0.9+dfsg-136.0.9+dfsg-2 |
None known |
rust-wasmtimeDebian:14 |
before 36.0.7+dfsg-1, plus listed versions 26.0.1+dfsg-1026.0.1+dfsg-326.0.1+dfsg-426.0.1+dfsg-526.0.1+dfsg-6 Show 29 moreShow less26.0.1+dfsg-726.0.1+dfsg-826.0.1+dfsg-927.0.0+dfsg-227.0.0+dfsg-327.0.0+dfsg-428.0.1+dfsg-128.0.1+dfsg-228.0.1+dfsg-329.0.1+dfsg-129.0.1+dfsg-229.0.1+dfsg-329.0.1+dfsg-429.0.1+dfsg-529.0.1+dfsg-629.0.1+dfsg-729.0.1+dfsg-836.0.5+dfsg-136.0.5+dfsg-236.0.5+dfsg-336.0.5+dfsg-436.0.5+dfsg-536.0.6+dfsg-136.0.6+dfsg-236.0.6+dfsg-336.0.6+dfsg-436.0.6+dfsg-536.0.6+dfsg-636.0.6+dfsg-7 |
36.0.7+dfsg-1 |
wasmtimecrates.io |
43.0.0 up to 43.0.1 | 43.0.1 |
Wasmtime_jllJulia |
before 45.0.1+0 | 45.0.1+0 |
wasmtimecrates.io |
0.0.0-0 up to 24.0.7, 25.0.0 up to 36.0.7, 37.0.0 up to 42.0.2, 43.0.0 up to 43.0.1 | 24.0.736.0.742.0.243.0.1 |
rust-wasmtimeUbuntu:24.04:LTS |
All versions, plus listed versions 10.0.1+dfsg-715.0.1+dfsg-416.0.0+dfsg-216.0.0+dfsg-3 |
None known |
rust-wasmtimeUbuntu:25.10 |
All versions, plus listed versions 26.0.1+dfsg-3 |
None known |
rust-wasmtimeUbuntu:26.10 |
All versions, plus listed versions 36.0.5+dfsg-136.0.13+dfsg-1 |
None known |
rust-wasmtimeUbuntu:26.04:LTS |
All versions, plus listed versions 26.0.1+dfsg-326.0.1+dfsg-428.0.1+dfsg-329.0.1+dfsg-536.0.5+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35195 is a medium vulnerability (CVSS 6.1) in Bytecodealliance Wasmtime, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in wasmtime 24.0.7.
References
github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm
nvd.nist.gov/vuln/detail/CVE-2026-35195
rustsec.org/advisories/RUSTSEC-2026-0091.html
security-tracker.debian.org/tracker/CVE-2026-35195
Show 28 moreShow less
crates.io/crates/wasmtime
suse.com/support/update/announcement/2026/suse-su-202621789-1
bugzilla.suse.com/1259205
ubuntu.com/security/CVE-2026-35195
cve.org/CVERecord?id=CVE-2026-35195