CVE-2026-34941: Wasmtime Heap OOB Read Vulnerability in UTF-16 to Latin1+UTF16 Transcoding
Summary
CVE-2026-34941: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding. Affects wasmtime across 4 version ranges.
< 24.0.7
>= 25.0.0, < 36.0.7
>= 37.0.0, < 42.0.2
>= 43.0.0, < 43.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Wasmtime is a popular runtime for executing WebAssembly (Wasm) components, designed to be efficient and secure. It allows developers to run Wasm code in various environments, providing features like component models and string handling. However, it is susceptible to vulnerabilities that can arise from improper memory management, particularly when transcoding strings between different encodings.
Vulnerability Detail
The vulnerability in Wasmtime arises during the transcoding of a UTF-16 string to the latin1+utf16 encoding. The issue stems from an incorrect validation of the input string's byte length, where the number of code units is checked instead of the actual byte length. This oversight can lead to out-of-bounds (OOB) memory access, allowing the host to read beyond the end of a WebAssembly's linear memory. In the default configuration, this results in a segmentation fault (segfault) due to accessing unmapped memory. If configured without guard pages, there is a risk of reading sensitive host memory, leading to potential information disclosure.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 24.0.724.0.7 -
>= 25.0.0, < 36.0.736.0.7 -
>= 37.0.0, < 42.0.242.0.2 -
>= 43.0.0, < 43.0.143.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no workarounds available for this vulnerability. It is strongly recommended that users update to a patched version of Wasmtime to mitigate the risk.
Conclusion
The Wasmtime vulnerability CVE-2026-34941 poses significant risks related to memory management and data security. Users are urged to update to the latest patched versions to protect their applications from potential exploitation. Regular monitoring and updates are essential for maintaining the security of software dependencies.
See every vulnerability recorded for wasmtime →
FAQ
CVE-2026-34941 is a vulnerability in Wasmtime that allows for out-of-bounds memory access during string transcoding, potentially leading to denial of service or information disclosure.
If your application uses untrusted WebAssembly components that involve cross-component string passing, it may be vulnerable to this issue, especially if guard pages are disabled.
Guard pages are memory regions that are not mapped to any physical memory, used to catch out-of-bounds memory access. Disabling them increases the risk of reading sensitive data.
You can use Vulert, a tool that monitors open-source vulnerabilities in real-time. By uploading your Cargo.lock file to the Vulert playground, you can check if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 6.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
