CVE-2026-34946

MEDIUM

Wasmtime has host panic when Winch compiler executes `table.fill`

Published April 9, 2026Updated May 5, 2026Source: osv

Summary

### Impact Wasmtime's Winch compiler contains a vulnerability where the compilation of the `table.fill` instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture, and cause the host to panic. This represents a denial-of-service vulnerability in Wasmtime due to guests being able to trigger a panic. The specific issue is that a historical refactoring, #11254, changed how compiled code referenced tables within the `table.*` instructions. This refactoring forgot to update the Winch code paths associated as well, meaning that Winch was using the wrong indexing scheme. Due to the feature support of Winch the only problem that can result is tables being mixed up or nonexistent tables being used, meaning that the guest is limited to panicking the host (using a nonexistent table), or executing spec-incorrect behavior and modifying the wrong table. ### Patches Wasmtime 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds Users of Cranelift are not affected by this issue, but for users of Winch there is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 36.0.7 or later

cargo update -p wasmtime --precise 36.0.7

Cargo

Update wasmtime to 42.0.2 or later

cargo update -p wasmtime --precise 42.0.2

Cargo

Update wasmtime to 43.0.1 or later

cargo update -p wasmtime --precise 43.0.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	36.0.7
wasmtime	crates.io	All versions	42.0.2
wasmtime	crates.io	43.0.0	43.0.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-248
View on MITRE
CWE-670
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34946?: Wasmtime has host panic when Winch compiler executes `table.fill` This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-34946?: CVE-2026-34946 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34946 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-q49f-xg75-m9xw

RUSTSEC-2026-0089

Related CVEs

CVE-2023-26489
CRITICAL
Guest-controlled out-of-bounds read/write on x86\_64
CVE-2026-34987
CRITICAL
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
CVE-2022-39392
HIGH
Bug in Wasmtime implementation of pooling instance allocator
CVE-2022-39393
HIGH
Data leakage between instances in the pooling allocator
CVE-2026-35195
HIGH
Out-of-bounds write or crash when transcoding component model strings
CVE-2026-27204
MEDIUM
Guest-controlled resource exhaustion in WASI implementations
CVE-2026-27572
MEDIUM
Panic adding excessive fields to a `wasi:http/types.fields` instance
CVE-2026-34942
MEDIUM
Panic when transcoding misaligned component model UTF-16 strings

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies