CVE-2026-34945: 
Rust vulnerability analysis and mitigation

CVE-2026-34945 is a host data leakage vulnerability in Wasmtime's Winch compiler, where the table.size instruction for 64-bit tables (part of the WebAssembly memory64 proposal) is incorrectly translated, potentially exposing host stack data to WebAssembly guests. It affects Wasmtime versions 25.0.0 through 36.0.6, 37.0.0 through 42.0.1, and 43.0.0. The vulnerability was published on April 9, 2026, by alexcrichton of the Bytecode Alliance. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 2.3 (Low) (Github Advisory, Wasmtime Advisory).

The root cause is an incorrect conversion between numeric types (CWE-681) combined with exposure of sensitive information (CWE-200): the return value of the table.size instruction was statically typed as a 32-bit integer rather than dynamically consulting the table's index type to determine the correct register width for 64-bit tables. When Winch's ABI details — specifically multi-value returns — are factored in, the upper bits of the return register may contain residual host stack data that is then readable by the WebAssembly guest. Exploitation requires the attacker to have low-level network access and the ability to submit WebAssembly modules using 64-bit tables with the memory64 proposal enabled; users of the Cranelift compiler backend are not affected (Github Advisory, Wasmtime Advisory).

Successful exploitation allows a WebAssembly guest to read arbitrary data from the host's stack memory, which may include sensitive information from other host-originating operations such as cryptographic material, credentials, or internal application state. There is no integrity or availability impact — the vulnerability is limited to confidentiality. The scope is contained to the Wasmtime process, with no direct path to lateral movement, but leaked stack data could facilitate further attacks depending on what sensitive values are present (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.014% (3rd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires attack prerequisites to be present (e.g., the memory64 proposal must be enabled and the Winch compiler must be in use), which further limits practical exploitability.

1. Identify target: Locate a Wasmtime deployment using the Winch compiler backend with the Config::wasm_memory64 proposal enabled, running an affected version (25.0.0–36.0.6, 37.0.0–42.0.1, or 43.0.0).
2. Craft malicious WebAssembly module: Write a WebAssembly module that declares a 64-bit table (using the memory64 proposal) and invokes the table.size instruction, leveraging multi-value return semantics to capture the full register value returned by Winch.
3. Submit module for execution: Upload or supply the crafted .wasm module to the target Wasmtime instance (e.g., via an API, plugin interface, or serverless function endpoint that accepts guest Wasm modules).
4. Read leaked stack data: Inspect the upper 32 bits of the table.size return value, which due to the type mismatch bug may contain residual host stack data not zeroed out by Winch's code generation.
5. Analyze leaked data: Repeat the operation to collect multiple stack snapshots and analyze for sensitive values such as pointers, keys, or other host-side data (Github Advisory, Wasmtime Advisory).

Users should upgrade Wasmtime to the patched versions: 36.0.7 (for versions 25.0.0–36.0.6), 42.0.2 (for versions 37.0.0–42.0.1), or 43.0.1 (for version 43.0.0). As a workaround for those unable to upgrade immediately, disabling the Config::wasm_memory64 proposal eliminates the vulnerable code path; users of the Cranelift compiler backend are not affected and require no action. Restricting network access and limiting which WebAssembly modules can be submitted to Wasmtime instances can reduce exposure risk in the interim (Github Advisory, Wasmtime Advisory).

The Bytecode Alliance published a security advisory and a broader security advisories article covering this and related issues. The vulnerability was credited to researcher "shumbo" and coordinated by alexcrichton. No significant broader media coverage or notable community debate has been observed, consistent with the low CVSS severity rating (Bytecode Alliance, Github Advisory).