CVE catalog

CVE-2026-34942

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improper

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpewasmtimeNot reported24.0.7fixed
CpewasmtimeNot reported36.0.7fixed
CpewasmtimeNot reported42.0.2fixed
CpewasmtimeNot reported43.0.1fixed
Debianrust-wasmtime1326.0.1+dfsg-10vulnerable
Debianrust-wasmtime1326.0.1+dfsg-3vulnerable
Debianrust-wasmtime1326.0.1+dfsg-4vulnerable
Debianrust-wasmtime1326.0.1+dfsg-5vulnerable
Debianrust-wasmtime1326.0.1+dfsg-6vulnerable
Debianrust-wasmtime1326.0.1+dfsg-7vulnerable
Debianrust-wasmtime1326.0.1+dfsg-8vulnerable
Debianrust-wasmtime1326.0.1+dfsg-9vulnerable
Debianrust-wasmtime1327.0.0+dfsg-2vulnerable
Debianrust-wasmtime1327.0.0+dfsg-3vulnerable
Debianrust-wasmtime1327.0.0+dfsg-4vulnerable
Debianrust-wasmtime1328.0.1+dfsg-1vulnerable
Debianrust-wasmtime1328.0.1+dfsg-2vulnerable
Debianrust-wasmtime1328.0.1+dfsg-3vulnerable
Debianrust-wasmtime1329.0.1+dfsg-1vulnerable
Debianrust-wasmtime1329.0.1+dfsg-2vulnerable
Debianrust-wasmtime1329.0.1+dfsg-3vulnerable
Debianrust-wasmtime1329.0.1+dfsg-4vulnerable
Debianrust-wasmtime1329.0.1+dfsg-5vulnerable
Debianrust-wasmtime1329.0.1+dfsg-6vulnerable
Debianrust-wasmtime1329.0.1+dfsg-7vulnerable
Debianrust-wasmtime1329.0.1+dfsg-8vulnerable
Debianrust-wasmtime1336.0.11+dfsg-1vulnerable
Debianrust-wasmtime1336.0.12+dfsg-1vulnerable
Debianrust-wasmtime1336.0.12+dfsg-2vulnerable
Debianrust-wasmtime1336.0.12+dfsg-3vulnerable
Debianrust-wasmtime1336.0.13+dfsg-1vulnerable
Debianrust-wasmtime1336.0.5+dfsg-1vulnerable
Debianrust-wasmtime1336.0.5+dfsg-2vulnerable
Debianrust-wasmtime1336.0.5+dfsg-3vulnerable
Debianrust-wasmtime1336.0.5+dfsg-4vulnerable
Debianrust-wasmtime1336.0.5+dfsg-5vulnerable
Debianrust-wasmtime1336.0.6+dfsg-1vulnerable
Debianrust-wasmtime1336.0.6+dfsg-2vulnerable
Debianrust-wasmtime1336.0.6+dfsg-3vulnerable
Debianrust-wasmtime1336.0.6+dfsg-4vulnerable
Debianrust-wasmtime1336.0.6+dfsg-5vulnerable
Debianrust-wasmtime1336.0.6+dfsg-6vulnerable
Debianrust-wasmtime1336.0.6+dfsg-7vulnerable
Debianrust-wasmtime1336.0.7+dfsg-1vulnerable
Debianrust-wasmtime1336.0.8+dfsg-1vulnerable
Debianrust-wasmtime1336.0.9+dfsg-1vulnerable
Debianrust-wasmtime1336.0.9+dfsg-2vulnerable
Debianrust-wasmtime1426.0.1+dfsg-10vulnerable
Debianrust-wasmtime1426.0.1+dfsg-3vulnerable
Debianrust-wasmtime1426.0.1+dfsg-4vulnerable
Debianrust-wasmtime1426.0.1+dfsg-5vulnerable
Debianrust-wasmtime1426.0.1+dfsg-6vulnerable
Debianrust-wasmtime1426.0.1+dfsg-7vulnerable
Debianrust-wasmtime1426.0.1+dfsg-8vulnerable
Debianrust-wasmtime1426.0.1+dfsg-9vulnerable
Debianrust-wasmtime1427.0.0+dfsg-2vulnerable
Debianrust-wasmtime1427.0.0+dfsg-3vulnerable
Debianrust-wasmtime1427.0.0+dfsg-4vulnerable
Debianrust-wasmtime1428.0.1+dfsg-1vulnerable
Debianrust-wasmtime1428.0.1+dfsg-2vulnerable
Debianrust-wasmtime1428.0.1+dfsg-3vulnerable
Debianrust-wasmtime1429.0.1+dfsg-1vulnerable
Debianrust-wasmtime1429.0.1+dfsg-2vulnerable
Debianrust-wasmtime1429.0.1+dfsg-3vulnerable
Debianrust-wasmtime1429.0.1+dfsg-4vulnerable
Debianrust-wasmtime1429.0.1+dfsg-5vulnerable
Debianrust-wasmtime1429.0.1+dfsg-6vulnerable
Debianrust-wasmtime1429.0.1+dfsg-7vulnerable
Debianrust-wasmtime1429.0.1+dfsg-8vulnerable
Debianrust-wasmtime1436.0.5+dfsg-1vulnerable
Debianrust-wasmtime1436.0.5+dfsg-2vulnerable
Debianrust-wasmtime1436.0.5+dfsg-3vulnerable
Debianrust-wasmtime1436.0.5+dfsg-4vulnerable
Debianrust-wasmtime1436.0.5+dfsg-5vulnerable
Debianrust-wasmtime1436.0.6+dfsg-1vulnerable
Debianrust-wasmtime1436.0.6+dfsg-2vulnerable
Debianrust-wasmtime1436.0.6+dfsg-3vulnerable
Debianrust-wasmtime1436.0.6+dfsg-4vulnerable
Debianrust-wasmtime1436.0.6+dfsg-5vulnerable
Debianrust-wasmtime1436.0.6+dfsg-6vulnerable
Debianrust-wasmtime1436.0.6+dfsg-7vulnerable
Debianrust-wasmtime1436.0.7+dfsg-1fixed
CpewasmtimeNot reported43.0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpewasmtimecpeNot reported24.0.7Not reportedNot reportedNot reported
CpewasmtimecpeNot reported36.0.7Not reportedNot reportedNot reported
CpewasmtimecpeNot reported42.0.2Not reportedNot reportedNot reported
CpewasmtimecpeNot reported43.0.1Not reportedNot reportedNot reported
Debianrust-wasmtimedeb1436.0.7+dfsg-1Not reportedDEBIAN-CVE-2026-34942Not reported
CpewasmtimecpeNot reported43.0.1Not reportedNVD-CVE-2026-34942Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-cranelift-dev]Affected

    Source package: [rust-wasmtime]

    Details (2)

    • 0.113.1+26.0.1+dfsg-3 · all · trixie

      Affected

      nvd · rust-wasmtime · debian · 13

    • 0.113.1+26.0.1+dfsg-3 · all · trixie

      Affected

      nvd · rust-wasmtime · debian · 13

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]