CVE-2026-34945

Wasmtime leaks host data with 64-bit tables and Winch

Published Apr 9, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Analysis

Technical impact

A bug in Wasmtime’s Winch compiler misinterprets the table.size instruction for 64‑bit tables, returning a 32‑bit value when the correct size is larger. This mismatch allows a WebAssembly guest to read data that resides on the host’s stack, potentially exposing sensitive information that should remain hidden from untrusted guest code. The flaw represents an integer type mismatch weakness (CWE‑681).

Affected Systems

Bytecodealliance Wasmtime releases from 25.0.0 up to, but not including, 36.0.7, as well as the versions 42.0.2 and 43.0.1, contain the vulnerability. These releases have been corrected in 36.0.7, 42.0.2, and 43.0.1.

Risk and Exploitability

The CVSS score of 2.3 indicates low overall risk. Based on the description, it is inferred that an attacker must be able to execute WebAssembly code within a vulnerable Wasmtime instance to trigger the leak, suggesting a local or controlled code execution scenario rather than a traditional remote attack vector. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, implying limited current exploit activity, but host systems running untrusted Wasm code remain at risk of accidental data disclosure.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

bytecodealliance

wasmtime

affected

Version	Status	Constraints
`>= 25.0.0, < 36.0.7`	affected	—
`>= 37.0.0, < 42.0.2`	affected	—
`>= 43.0.0, < 44.0.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*
	cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*
	cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*

No data.

Vendor Product Versions

Bytecodealliance

Wasmtime

Version	Status	Scheme	Platform
`[25.0.0,36.0.7)`	affected	semver	—
`[37.0.0,42.0.2)`	affected	semver	—
`[43.0.0,44.0.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Wasmtime to version 36.0.7, 42.0.2, 43.0.1 or later

Generated by OpenCVE AI on April 9, 2026 at 22:05 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-m9w2-8782-2946	Wasmtime has host data leakage with 64-bit tables and Winch

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.336% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946
https://nvd.nist.gov/vuln/detail/CVE-2026-34945
https://www.cve.org/CVERecord?id=CVE-2026-34945

History

Apr 20, 2026 6:30 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:bytecodealliance:wasmtime::::::rust::*
Metrics	cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Apr 10, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 10, 2026 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Bytecodealliance Bytecodealliance wasmtime
Vendors & Products		Bytecodealliance Bytecodealliance wasmtime

Apr 10, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-34945 https://www.cve.org/CVERecord?id=CVE-2026-34945
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}` threat_severity `Moderate`

Apr 9, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
Title		Wasmtime leaks host data with 64-bit tables and Winch
Weaknesses		CWE-681
References		https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946
Metrics		cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}`