Red Hat CVE-2026-35195

Wasmtime is a WebAssembly runtime that implements component-based interoperability including string transcoding between guest components and the host. The vulnerability resides in the string transcoding logic, which calls a guest-provided realloc function to allocate memory for transcoded strings. The root cause (CWE-787: Out-of-bounds Write) stems from insufficient validation of the realloc return value before the host writes transcoded string data through the returned pointer. The guest component can return an arbitrary pointer value, allowing the host to write controlled data to any memory location within the 4GiB address range. The impact depends critically on Wasmtime's memory configuration: the default setup reserves 4GiB of contiguous virtual address space with guard pages at the boundaries, causing out-of-bounds writes to fault on unmapped memory; non-default configurations that reduce the virtual memory reservation or remove guard pages allow direct memory corruption. Affected products span the Wasmtime runtime across all versions prior to the patched releases (CPE: cpe:2.3:a:bytecodealliance:wasmtime).