What is the CVSS score of CVE-2026-34941?

CVE-2026-34941 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34941?

Yes, a patch is available for CVE-2026-34941. Update the affected software to the latest version immediately.

Wasmtime CVE-2026-34941

EUVD-2026-20988 MEDIUM

Out-of-bounds Read (CWE-125)

2026-04-09 GitHub_M

GHSA-hx6p-xpx3-jvvv

Buffer Overflow Information Disclosure Wasmtime Bytecodealliance

6.9

CVSS 4.0 · GitHub Advisory

View

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS v4.0 score of 6.9 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) requiring authenticated user interaction (PR:L, UI:P). The vector indicates availability impact (VA:H) but no confidentiality, integrity, or system-wide impact in standard configurations. Real-world risk assessment reveals a moderate practical threat with important caveats: first, the vulnerability requires authentication and user interaction (clicking/accepting), narrowing the attack surface; second, the default Wasmtime configuration with guard pages mitigates the worst case (host memory disclosure) by terminating the process cleanly via segfault. The denial-of-service impact (process termination) is confirmed in default deployments, making this a valid availability threat for availability-critical WebAssembly services. Information disclosure (VI:H in the vulnerability description) is only possible in non-standard deployments without guard pages, which is a deliberate deviation from secure defaults. The ENISA EUVD classification as a known vulnerability without urgent zero-day designation supports a moderate-priority remediation posture rather than critical emergency response. This is best characterized as a real but bounded risk: high CVSS due to network access and authenticated availability impact, but moderate practical priority due to default-mitigated worst case and user interaction requirement.
Exploit ScenarioDerived	A legitimate authenticated user (for example, a developer with access to a Wasmtime-based service) could craft or upload a WebAssembly module containing a component that triggers the UTF-16 transcoding path with an oversized string length field. Upon execution, the transcoding function reads beyond the linear memory boundary, either segfaulting the process (default configuration) or reading adjacent host memory (non-standard guard-page-disabled configuration). In a multi-tenant or service-oriented deployment, this causes denial-of-service by terminating the runtime; in non-standard configurations, it could leak sensitive data from adjacent memory regions. No public proof-of-concept code has been published; exploitation requires knowledge of the specific bounds-check flaw and ability to invoke the vulnerable component-model transcoding path.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Wasmtime runtime versions prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 incorrectly validate UTF-16 string byte lengths during component-model encoding transcoding, causing out-of-bounds memory reads that trigger process termination via segfault in default configurations or potentially expose host memory when guard pages are disabled. Authenticated users with UI interaction can trigger this denial-of-service vulnerability; reading beyond linear memory requires non-standard Wasmtime configuration without guard pages. No public exploit code has been identified at time of analysis.

RemediationAI

Upgrade Wasmtime immediately to one of the patched versions: 24.0.7 (for the 24.x series), 36.0.7 (for the 25-36 series), 42.0.2 (for the 37-42 series), or 43.0.1 (for the 43.x series and later). The Bytecode Alliance security advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv provides detailed patched version information and verification guidance. As a temporary mitigation, if immediate patching is not feasible, ensure Wasmtime is deployed with its default guard-page protection enabled (do not disable guard pages in configuration), which limits this vulnerability to process denial-of-service rather than host memory disclosure. Validate that no custom Wasmtime builds in production use the guard-page-disabled mode.

Affected VersionsENISA

wasmtime 37.0.0, < 42.0.2

wasmtime 43.0.0, < 44.0.1

wasmtime 25.0.0, < 36.0.7

wasmtime < 24.0.7

Affected Packages

cargo wasmtime fix: 24.0.7, 36.0.7, 42.0.2, 43.0.1, 44.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Wasmtime is a WebAssembly runtime maintained by the Bytecode Alliance. The vulnerability resides in the component-model encoding layer, specifically in UTF-16 to latin1+utf16 transcoding logic. When validating buffer bounds before transcoding a UTF-16 string, the runtime incorrectly checks the count of code units (16-bit values) against the buffer size rather than the actual byte length, which is twice the code unit count for UTF-16 data. This is an instance of CWE-125 (Out-of-bounds Read), a classic buffer over-read vulnerability. The bounds check failure allows the transcoding function to attempt reading beyond the allocated linear memory region of a WebAssembly module. In Wasmtime's default configuration, memory guard pages protect against this by catching the read on unmapped memory and terminating the process. However, if Wasmtime is explicitly configured without guard pages (a non-standard but supported mode), the out-of-bounds read may access adjacent host memory, potentially exposing sensitive data.

Know when Wasmtime gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat 5.3 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 09, 2026 - 18:29 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly's linear memory in an attempt to transcode nonexistent bytes. In Wasmtime's default configuration this will read unmapped memory on a guard page, terminating the process with a segfault. Wasmtime can be configured, however, without guard pages which would mean that host memory beyond the end of linear memory may be read and interpreted as UTF-16. A host segfault is a denial-of-service vulnerability in Wasmtime, and possibly being able to read beyond the end of linear memory is additionally a vulnerability. Note that reading beyond the end of linear memory requires nonstandard configuration of Wasmtime, specifically with guard pages disabled. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Threat Intelligence Overview

EPSS Score

0.0%

Top 97% exploitable

Threat Intel

1 source

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +34

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.