What is the CVSS score of CVE-2026-34987?

CVE-2026-34987 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-34987?

Within 24 hours: Identify all Wasmtime deployments and determine if Winch compiler is enabled (check for -Ccompiler=winch flag or equivalent configuration); disable Winch compiler immediately by removing the flag or reverting to default compiler if business logic permits. Within 7 days: Audit all WebAssembly modules currently executing in affected Wasmtime instances and evaluate trust levels; implement network segmentation isolating Wasmtime services from sensitive data stores. Within 30 days: Upgrade to patched versions (Wasmtime 36.0.7, 42.0.2, 43.0.1, or later as released) after vendor confirmation; validate patch deployment across all environments and re-enable Winch only after security review.

Wasmtime CVE-2026-34987

Q: Which versions of Wasmtime are affected by CVE-2026-34987?

Wasmtime's Winch compiler contains a critical memory sandbox escape (CVE-2026-34987, CVSS 9.0) allowing authenticated WebAssembly guests to read and write arbitrary host process memory, potentially…. A patch is available.

EUVD-2026-21031 CRITICAL

Out-of-bounds Read (CWE-125)

2026-04-09 GitHub_M

GHSA-xx5w-cvp6-jv83

Buffer Overflow Information Disclosure Wasmtime Bytecodealliance

9.0

CVSS 4.0 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Configure Wasmtime with Winch compiler backend
Exploit

Craft malicious WebAssembly module
Execution

Execute module to escape linear memory sandbox
Impact

Access arbitrary host memory outside bounds

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires Wasmtime versions 25.0.0–36.0.6, 42.0.0–42.0.1, or 43.0.0 configured with non-default Winch compiler backend (-Ccompiler=winch). Attacker must provide crafted WebAssembly guest code executed by the runtime. Default Cranelift backend is not affected.
Impact	CVSS 9.0 with high integrity/availability impact reflects sandbox escape enabling arbitrary memory access, data exfiltration, or potential RCE. However, exploitation requires authenticated Wasm execution via non-default Winch compiler backend; default Cranelift unaffected. Practical x86-64 reach remains theoretical. Risk tier depends heavily on Winch adoption in production deployments.
Exploit ScenarioDerived	Authenticated attacker submits malformed Wasm bytecode compiled with Winch backend, exploiting 32-bit offset sign-extension bug in register handling. aarch64 proof-of-concept confirmed; x86-64 theoretical. No public exploit identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Memory sandbox escape in Wasmtime's Winch compiler (versions 25.0.0 to before 36.0.7, 42.0.2, 43.0.1) enables authenticated WebAssembly guests to access arbitrary host process memory outside linear-memory boundaries. Exploitation requires non-default Winch backend activation via -Ccompiler=winch flag. Attackers can read up to 32KiB before memory start or ~4GiB after, with theoretical potential for unlimited in-process memory access due to improper 32-bit offset handling in 64-bit registers. Consequences include host process crashes (DoS), sensitive data exfiltration, or remote code execution through memory writes. Affects aarch64 (confirmed PoC) and x86-64 (theoretical). Publicly available exploit code exists.

RemediationAI

Vendor-released patches: upgrade to Wasmtime 36.0.7, 42.0.2, or 43.0.1 immediately. Organizations unable to patch must disable Winch compiler by removing -Ccompiler=winch flag or switching to default Cranelift backend. Verify compiler configuration in deployment scripts and CI/CD pipelines. Monitor process memory access patterns for anomalous behavior. For containerized Wasmtime deployments, enforce strict memory limits and apply security policies restricting compiler backend selection. Advisory URL: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83. No workaround exists for environments requiring Winch; patching is mandatory to eliminate sandbox escape risk.

Affected VersionsENISA

wasmtime 25.0.0, < 36.0.7

wasmtime 43.0.0, < 44.0.1

wasmtime 37.0.0, < 42.0.2

Affected Packages

cargo wasmtime fix: 36.0.7, 42.0.2, 43.0.1, 44.0.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in cargo

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-125 out-of-bounds read stems from Winch compiler's failure to clear upper 32 bits of 64-bit registers holding memory offsets, violating sandbox assumptions. Unlike default Cranelift backend, Winch incorrectly trusts zero-extension of 32-bit Wasm offsets, enabling offset manipulation to bypass guard-region protections on both architectures. Proof-of-concept demonstrates reliable aarch64 exploitation; x86-64 variant remains unconfirmed.

Know when Wasmtime gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE 9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 09, 2026 - 18:48 nvd

CRITICAL 9.0

DescriptionCVE.org

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Executive ViewAI

Why It Matters

Wasmtime's Winch compiler contains a critical memory sandbox escape (CVE-2026-34987, CVSS 9.0) allowing authenticated WebAssembly guests to read and write arbitrary host process memory, potentially enabling data theft, system crashes, or code execution. Organizations running Wasmtime 25.0.0 through 43.0.1 with the Winch compiler enabled face immediate risk to any service executing untrusted WebAssembly code, particularly on aarch64 systems where exploitation is confirmed possible.

Business Impact: Severe

Compensating Controls

Immediate mitigation: Disable Winch compiler backend by removing -Ccompiler=winch configuration flag and reverting to default compiler. Restrict WebAssembly execution to signed/verified modules only; implement strict network isolation for Wasmtime processes; disable untrusted WebAssembly module execution until patched. These controls reduce but do not eliminate risk-patch application is mandatory.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Threat Intel

1 source

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +45

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.