Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Wasmtime Winch backend can let WebAssembly read host memory

CVE-2026-34987 · published 6 months ago
Summary

Versions of Wasmtime that use the optional Winch compiler may let a WebAssembly program peek outside its own memory area and read or write the host's memory. This could cause crashes, data leaks, or allow an attacker to run code on the server. Update Wasmtime to version 36.0.7 or later (or 42.0.2 / 43.0.1) to eliminate the risk.

What to do
  • Update wasmtime-publish wasmtime to version 43.0.1.
  • Update wasmtime-publish wasmtime to version 36.0.7.
  • Update wasmtime-publish wasmtime to version 42.0.2.
  • Update wasmtime to version 43.0.1.
Affected software
Ecosystem VendorProductAffected versions
crates.io wasmtime-publish wasmtime >= 43.0.0, < 43.0.1
Fix: upgrade to 43.0.1
Debian:13 debian rust-wasmtime All versions
Debian:14 debian rust-wasmtime All versions
rust wasmtime-publish wasmtime >= 25.0.0, < 36.0.7
>= 37.0.0, < 42.0.2
43.0.0
Fix: upgrade to 36.0.7
– bytecodealliance wasmtime >= 25.0.0, < 36.0.7
>= 37.0.0, < 42.0.2
43.0.0
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*
crates.io – wasmtime >= 43.0.0, < 43.0.1
Fix: upgrade to 43.0.1
Ubuntu:24.04:LTS canonical rust-wasmtime All versions
Original advisory text
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
CWE-787Out-of-bounds Write
Timeline
Published9 Apr 2026
Updated4 Nov 2026
First seen9 Apr 2026
Sources
DEBIAN-CVE-2026-34987 · OSV
CVE-2026-34987 · NVD
RUSTSEC-2026-0095 · OSV
GHSA-xx5w-cvp6-jv83 · GHSA
GHSA-xx5w-cvp6-jv83 · OSV
UBUNTU-CVE-2026-34987 · OSV
CVE-2026-34987 · OSV
Track software like this
Free during beta