CVE-2026-34942 — Vulnerability in wasmtime — CVE Details

MEDIUM

Wasmtime: Panic when transcoding misaligned utf-16 strings

Published April 9, 2026Updated September 10, 2026Source: osv

Summary

### Impact Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Advisory Timeline

First published April 9, 2026 (186 days ago).
Last revised September 10, 2026 — 153 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 36.0.7 or later

cargo update -p wasmtime --precise 36.0.7

Cargo

Update wasmtime to 42.0.2 or later

cargo update -p wasmtime --precise 42.0.2

Cargo

Update wasmtime to 43.0.1 or later

cargo update -p wasmtime --precise 43.0.1

Cargo

Update wasmtime to 24.0.7 or later

cargo update -p wasmtime --precise 24.0.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	36.0.7
wasmtime	crates.io	All versions	42.0.2
wasmtime	crates.io	43.0.0	43.0.1
wasmtime	crates.io	All versions	24.0.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-119
Buffer OverflowMITRE
CWE-129
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34942?: Wasmtime: Panic when transcoding misaligned utf-16 strings This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-34942?: CVE-2026-34942 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34942 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-jxhv-7h78-9775

RUSTSEC-2026-0092

Related CVEs

CVE-2023-26489
CRITICAL
wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64
CVE-2026-34971
CRITICAL
Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
CVE-2022-24791
HIGH
Use after free in Wasmtime
CVE-2026-34941
MEDIUM
Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
CVE-2026-34943
MEDIUM
Wasmtime has a possible panic when lifting `flags` component value
CVE-2026-34946
MEDIUM
Wasmtime has host panic when Winch compiler executes `table.fill`
CVE-2024-47763
MEDIUM
wasmtime has a runtime crash when combining tail calls with trapping imports
CVE-2026-34945
LOW
Wasmtime has host data leakage with 64-bit tables and Winch

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies