Loading...
Skip to main content
GeekWala

CVE-2026-34942

MEDIUM

Wasmtime: Panic when transcoding misaligned utf-16 strings

Published April 9, 2026Updated May 5, 2026Source: osv

Summary

### Impact Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update wasmtime to 36.0.7 or later
cargo update -p wasmtime --precise 36.0.7
Cargo
Update wasmtime to 42.0.2 or later
cargo update -p wasmtime --precise 42.0.2
Cargo
Update wasmtime to 43.0.1 or later
cargo update -p wasmtime --precise 43.0.1
Cargo
Update wasmtime to 24.0.7 or later
cargo update -p wasmtime --precise 24.0.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

PackageEcosystemAffectedFixed In
wasmtime
crates.io
All versions36.0.7
wasmtime
crates.io
All versions42.0.2
wasmtime
crates.io
43.0.043.0.1
wasmtime
crates.io
All versions24.0.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34942?
Wasmtime: Panic when transcoding misaligned utf-16 strings This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-34942?
CVE-2026-34942 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34942 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-jxhv-7h78-9775
RUSTSEC-2026-0092

Related CVEs

  • CVE-2023-26489
    CRITICAL

    wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64

  • CVE-2026-34971
    CRITICAL

    Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

  • CVE-2026-27572
    MEDIUM

    Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

  • CVE-2026-35195
    MEDIUM

    Wasmtime has out-of-bounds write or crash when transcoding component model strings

  • CVE-2026-27204
    MEDIUM

    Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

  • CVE-2026-35186
    MEDIUM

    Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

  • CVE-2026-34941
    MEDIUM

    Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

  • CVE-2024-51745
    LOW

    Wasmtime doesn't fully sandbox all the Windows device filenames

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies