#VU125763 Out-of-bounds write in Wasmtime - CVE-2026-34987

Description

The vulnerability allows a remote user to access host memory outside the sandbox, disclose sensitive information, cause a denial of service, or potentially execute arbitrary code.

The vulnerability exists due to out-of-bounds write in the Winch compiler backend when compiling and executing properly constructed guest Wasm. A remote user can supply specially crafted guest Wasm to access host memory outside the linear-memory sandbox, disclose sensitive information, cause a denial of service, or potentially execute arbitrary code.

Only deployments using the non-default Winch compiler backend are vulnerable. The aarch64 case has an observed working proof of concept, while the x86-64 case is described as theoretical and may not be reachable in practice.

Remediation

External links

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83
• https://github.com/advisories/GHSA-xx5w-cvp6-jv83