Loading...
Skip to main content
GeekWala

CVE-2026-34946 — Vulnerability in wasmtime — CVE Details

MEDIUM

Wasmtime has host panic when Winch compiler executes `table.fill`

Published April 9, 2026Updated September 10, 2026Source: osv

Summary

### Impact Wasmtime's Winch compiler contains a vulnerability where the compilation of the `table.fill` instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability in Wasmtime due to guests being able to trigger a panic. The specific issue is that a historical refactoring, #11254, changed how compiled code referenced tables within the `table.*` instructions. This refactoring forgot to update the Winch code paths associated as well, meaning that Winch was using the wrong indexing scheme. Due to the feature support of Winch the only problem that can result is tables being mixed up or nonexistent tables being used, meaning that the guest is limited to panicking the host (using a nonexistent table), or executing spec-incorrect behavior and modifying the wrong table. ### Patches Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds Users of Cranelift are not affected by this issue, but for users of Winch there is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Advisory Timeline

  • First published April 9, 2026 (186 days ago).
  • Last revised September 10, 2026 — 153 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update wasmtime to 36.0.7 or later
cargo update -p wasmtime --precise 36.0.7
Cargo
Update wasmtime to 42.0.2 or later
cargo update -p wasmtime --precise 42.0.2
Cargo
Update wasmtime to 43.0.1 or later
cargo update -p wasmtime --precise 43.0.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
wasmtime
crates.io
All versions36.0.7
wasmtime
crates.io
All versions42.0.2
wasmtime
crates.io
43.0.043.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34946?
Wasmtime has host panic when Winch compiler executes `table.fill` This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-34946?
CVE-2026-34946 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34946 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-q49f-xg75-m9xw
RUSTSEC-2026-0089

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies