CVE-2026-34945

LOW

Wasmtime has host data leakage with 64-bit tables and Winch

Published April 9, 2026Updated May 5, 2026Source: osv

Summary

### Impact Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the `table.size` instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of `table.size` was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This information disclosure should not be possible in WebAssembly, violates spec semantics, and is a vulnerability in Wasmtime. ### Patches Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds Users of Cranelift are not affected by this issue, but users of Winch have no workarounds other than disabling the `Config::wasm_memory64` proposal.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 36.0.7 or later

cargo update -p wasmtime --precise 36.0.7

Cargo

Update wasmtime to 42.0.2 or later

cargo update -p wasmtime --precise 42.0.2

Cargo

Update wasmtime to 43.0.1 or later

cargo update -p wasmtime --precise 43.0.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	36.0.7
wasmtime	crates.io	All versions	42.0.2
wasmtime	crates.io	43.0.0	43.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-200
Information ExposureMITRE
CWE-681
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2026-34945?: Wasmtime has host data leakage with 64-bit tables and Winch This vulnerability has been assigned a severity rating of LOW (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2026-34945?: CVE-2026-34945 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34945 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-m9w2-8782-2946

RUSTSEC-2026-0086

Related CVEs

CVE-2026-34987
CRITICAL
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
CVE-2022-39392
HIGH
Bug in Wasmtime implementation of pooling instance allocator
CVE-2022-39393
HIGH
Wasmtime may have data leakage between instances in the pooling allocator
CVE-2026-34943
MEDIUM
Wasmtime has a possible panic when lifting `flags` component value
CVE-2026-34946
MEDIUM
Wasmtime has host panic when Winch compiler executes `table.fill`
CVE-2024-47763
MEDIUM
wasmtime has a runtime crash when combining tail calls with trapping imports
CVE-2026-34944
MEDIUM
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
CVE-2026-27195
MEDIUM
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies