bytecodealliance wasmtime up to 36.0.6/42.0.1/44.0.0 memory allocation

Summaryinfo

A vulnerability was found in bytecodealliance wasmtime up to 36.0.6/42.0.1/44.0.0. It has been classified as problematic. This affects an unknown part. Performing a manipulation results in memory allocation. This vulnerability is known as CVE-2026-35186. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in bytecodealliance wasmtime up to 36.0.6/42.0.1/44.0.0. This affects an unknown code block. The manipulation with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch's compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host's address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of table.grow that can be misinterpreted is -1. The bytes before linear memory are, by default, unmapped memory. Wasmtime will detect this fault and abort the process, however, because wasm should not be able to access these bytes. Overall this this bug in Winch represents a DoS vector by crashing the host process, a correctness issue within Winch, and a possible leak of up to 16-bytes before linear memory. Wasmtime's default compiler is Cranelift, not Winch, and Wasmtime's default settings are to place guard pages before linear memory. This means that Wasmtime's default configuration is not affected by this issue, and when explicitly choosing Winch Wasmtime's otherwise default configuration leads to a DoS. Disabling guard pages before linear memory is required to possibly leak up to 16-bytes of host data. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-35186 since 04/01/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 36.0.7, 42.0.2 or 44.0.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasmtime

Version

• 36.0.0
• 36.0.1
• 36.0.2
• 36.0.3
• 36.0.4
• 36.0.5
• 36.0.6
• 42.0.0
• 42.0.1
• 44.0

Website

• Product: https://github.com/bytecodealliance/wasmtime/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion