Is there a patch available for CVE-2026-34941?

Yes, a patch is available for CVE-2026-34941. Update the affected software to the latest version immediately.

Wasmtime CVE-2026-34941

Q: What is the CVSS score of CVE-2026-34941?

CVE-2026-34941 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20988 MEDIUM

Out-of-bounds Read (CWE-125)

2026-04-09 GitHub_M

GHSA-hx6p-xpx3-jvvv

Information Disclosure Buffer Overflow Wasmtime

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 18:45 euvd

EUVD-2026-20988

Analysis Generated

Apr 09, 2026 - 18:45 vuln.today

CVE Published

Apr 09, 2026 - 18:29 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

AnalysisAI

Wasmtime runtime versions prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 incorrectly validate UTF-16 string byte lengths during component-model encoding transcoding, causing out-of-bounds memory reads that trigger process termination via segfault in default configurations or potentially expose host memory when guard pages are disabled. Authenticated users with UI interaction can trigger this denial-of-service vulnerability; reading beyond linear memory requires non-standard Wasmtime configuration without guard pages. No public exploit code has been identified at time of analysis.

Technical ContextAI

Wasmtime is a WebAssembly runtime maintained by the Bytecode Alliance. The vulnerability resides in the component-model encoding layer, specifically in UTF-16 to latin1+utf16 transcoding logic. When validating buffer bounds before transcoding a UTF-16 string, the runtime incorrectly checks the count of code units (16-bit values) against the buffer size rather than the actual byte length, which is twice the code unit count for UTF-16 data. This is an instance of CWE-125 (Out-of-bounds Read), a classic buffer over-read vulnerability. The bounds check failure allows the transcoding function to attempt reading beyond the allocated linear memory region of a WebAssembly module. In Wasmtime's default configuration, memory guard pages protect against this by catching the read on unmapped memory and terminating the process. However, if Wasmtime is explicitly configured without guard pages (a non-standard but supported mode), the out-of-bounds read may access adjacent host memory, potentially exposing sensitive data.

RemediationAI

Upgrade Wasmtime immediately to one of the patched versions: 24.0.7 (for the 24.x series), 36.0.7 (for the 25-36 series), 42.0.2 (for the 37-42 series), or 43.0.1 (for the 43.x series and later). The Bytecode Alliance security advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv provides detailed patched version information and verification guidance. As a temporary mitigation, if immediate patching is not feasible, ensure Wasmtime is deployed with its default guard-page protection enabled (do not disable guard pages in configuration), which limits this vulnerability to process denial-of-service rather than host memory disclosure. Validate that no custom Wasmtime builds in production use the guard-page-disabled mode.