CVE-2026-44216

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

May 14, 2026, 2:54:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.32% · Oct 25, 2026

A flaw was found in Wasmtime, a runtime for WebAssembly. A remote attacker could exploit an arithmetic overflow vulnerability by instantiating a WebAssembly module or component that attempts to allocate an extremely large table using the WebAssembly memory64 proposal. This flaw causes Wasmtime to panic, resulting in a Denial of Service (DoS) for the affected system. wasmtime: Wasmtime: Denial of Service via large WebAssembly table allocation Red Hat has evaluated this vulnerability as Important because processing an untrusted WebAssembly module can cause the host application to crash, leading to a complete denial of service. In default configurations where the on-demand instance allocator and 64-bit memory extensions are active, maliciously oversized table definitions cause checked arithmetic operations to panic and terminate the host process ungracefully. Environments that restrict execution to verified, trusted WebAssembly binaries or do not ingest untrusted guest code remain unaffected by this issue. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.