CVE-2026-34941: 
Rust vulnerability analysis and mitigation

CVE-2026-34941 is a heap out-of-bounds read vulnerability in Wasmtime, a WebAssembly runtime developed by the Bytecode Alliance, affecting the component model's UTF-16 to latin1+utf16 string transcoding logic. The flaw was disclosed on April 9, 2026, and affects Wasmtime versions prior to 24.0.7, versions 25.0.0–36.0.6, versions 37.0.0–42.0.1, and version 43.0.0. It carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 6.9 (Medium/Moderate) (GitHub Advisory, Wasmtime Advisory).

The root cause is an incorrect bounds check during UTF-16 to latin1+utf16 string transcoding in Wasmtime's component model (CWE-125: Out-of-bounds Read; CWE-135: Incorrect Calculation of Multi-Byte String Length). The transcoding code validates the number of UTF-16 code units rather than the byte length, which is twice as large, causing the host runtime to attempt reading beyond the end of a WebAssembly module's linear memory when processing nonexistent bytes. Exploitation requires an attacker to supply a crafted WebAssembly component that performs cross-component string passing with a UTF-16 source encoding and a latin1+utf16 destination encoding (GitHub Advisory, Wasmtime Advisory).

In Wasmtime's default configuration (guard pages enabled), exploitation causes the host process to read unmapped memory on a guard page, triggering a SIGBUS/SIGSEGV and terminating the process — a denial-of-service condition. In non-standard configurations where guard pages are disabled, the host may read and interpret arbitrary host memory beyond the WebAssembly linear memory boundary as UTF-16, enabling potential information disclosure of sensitive host memory contents. Integrity is not impacted, and there is no evidence of lateral movement capability (GitHub Advisory, Wasmtime Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.014–0.019%, placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (e.g., the ability to submit a WebAssembly component for execution) and passive user interaction, limiting the practical attack surface to environments that run untrusted Wasm components with cross-component string passing.

1. Identify a target: Locate a service or application running a vulnerable version of Wasmtime (prior to 24.0.7, 25.0.0–36.0.6, 37.0.0–42.0.1, or 43.0.0) that accepts and executes untrusted WebAssembly components.
2. Craft a malicious Wasm component: Create a WebAssembly component that performs cross-component string passing using a UTF-16 source encoding and a latin1+utf16 destination encoding, with a string whose code unit count is near the boundary of the module's linear memory.
3. Trigger the bounds check flaw: Submit the crafted component for execution. The transcoding logic checks code units instead of byte length, causing the host to attempt reading twice as far into memory as intended.
4. Achieve denial-of-service (default config): With guard pages enabled, the out-of-bounds read hits unmapped memory, causing a segfault (SIGBUS/SIGSEGV) that crashes the host Wasmtime process.
5. Achieve information disclosure (non-default config): If guard pages are disabled, the out-of-bounds read returns host memory contents beyond the WebAssembly linear memory, which are then interpreted as UTF-16 data and potentially returned to the attacker (GitHub Advisory, Wasmtime Advisory).

• Process: Unexpected termination of the Wasmtime host process with SIGBUS or SIGSEGV signals; crash dumps referencing memory access violations near the boundary of WebAssembly linear memory.
• Logs: Application or system logs showing repeated segfault or bus error events associated with Wasmtime process execution; error messages related to UTF-16 or latin1+utf16 string transcoding in component model operations.
• Network: Unusual or repeated submission of WebAssembly components to a Wasmtime-backed service, particularly components involving cross-component string passing with UTF-16 encodings.
• File System: Core dump files generated by the Wasmtime process following unexpected crashes, which may indicate repeated exploitation attempts.

Bytecode Alliance has released patched versions: 24.0.7, 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to the appropriate patched version for their release branch immediately. There is no configuration-based workaround available; the vendor explicitly states that updating to a patched version is the only remediation. As an interim risk-reduction measure, ensure that Wasmtime's guard pages remain enabled (the default configuration) to limit the impact to denial-of-service rather than information disclosure, and avoid running untrusted WebAssembly components until patching is complete (GitHub Advisory, Wasmtime Advisory).

The vulnerability was reported by researcher "shumbo" and acknowledged by Bytecode Alliance maintainer Alex Crichton, who published the advisory and coordinated the fix (Wasmtime Advisory). The Bytecode Alliance published a security advisories article covering this and related issues (Bytecode Alliance). The Zed editor project also issued a patch commit in response to this vulnerability, indicating downstream impact on projects embedding Wasmtime. OpenSUSE issued security announcements for affected packages in their distribution.