bytecodealliance wasmtime up to 43.0.0 API Call wasmtime::Linker use after free

Summaryinfo

A vulnerability was found in bytecodealliance wasmtime up to 43.0.0 and classified as critical. This issue affects the function wasmtime::Linker of the component API Call Handler. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2026-34983. The physical device can be targeted for the attack. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in bytecodealliance wasmtime up to 43.0.0. It has been declared as problematic. This vulnerability affects the function wasmtime::Linker of the component API Call Handler. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-34983 since 03/31/2026. The exploitation appears to be difficult. The attack needs to be approached locally. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 305827 (Linux Distros Unpatched Vulnerability : CVE-2026-34983), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 43.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (305827). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasmtime

Version

• 43.0

Website

• Product: https://github.com/bytecodealliance/wasmtime/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion