Is there a patch available for CVE-2026-34942?

Yes, a patch is available for CVE-2026-34942. Update the affected software to the latest version immediately.

Wasmtime CVE-2026-34942

Q: What is the CVSS score of CVE-2026-34942?

CVE-2026-34942 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20990 MEDIUM

Improper Validation of Array Index (CWE-129)

2026-04-09 GitHub_M

GHSA-jxhv-7h78-9775

Information Disclosure Wasmtime

5.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.6 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 18:45 euvd

EUVD-2026-20990

Analysis Generated

Apr 09, 2026 - 18:45 vuln.today

CVE Published

Apr 09, 2026 - 18:32 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

AnalysisAI

Wasmtime prior to versions 24.0.7, 36.0.7, 42.0.2, and 43.0.1 fails to properly validate pointer alignment when transcoding strings into UTF-16 or Latin-1+UTF-16 encodings within the Component Model, allowing authenticated malicious WebAssembly guests to trigger host panics by passing specially crafted unaligned pointers across component boundaries. This denial-of-service vulnerability requires authenticated access and specific string configurations but results in controllable host crashes. CVSS score 5.9 reflects moderate severity with attack vector network and authentication requirement; SSVC framework rates exploitation as not yet observed with non-automatable exploitation.

Technical ContextAI

Wasmtime's Component Model provides a standardized interface for WebAssembly components to interact with host runtimes through string transcoding operations. The vulnerability resides in the string transcoding implementation for UTF-16 and Latin-1+UTF-16 character encodings, where memory reallocation occurs during the conversion process. The root cause is inadequate alignment verification of reallocated memory pointers prior to passing them to host functions for transcoding. CWE-129 (Improper Validation of Array Index) indicates that the vulnerability stems from insufficient bounds or alignment checking on memory addresses used as array indices or for direct memory operations. Affected products are identified by CPE cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*, affecting all Wasmtime versions below the patched releases across multiple release branches.

RemediationAI

Upgrade to Wasmtime 24.0.7, 36.0.7, 42.0.2, or 43.0.1 or later depending on your currently deployed branch. These patched versions correct the alignment validation in string transcoding implementations. No workarounds are available for affected versions; patching is the only remediation. Users should prioritize updates if running untrusted or adversarially-controlled WebAssembly guests, as the vulnerability requires authenticated access and guest-side code execution but results in controllable host crashes. Consult https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775 for release notes and confirmation of patch availability.