CVE-2026-34946: 
Rust vulnerability analysis and mitigation

CVE-2026-34946 is a denial-of-service vulnerability in Wasmtime's Winch compiler, where compilation of the table.fill WebAssembly instruction can trigger a host panic. It affects Wasmtime versions 25.0.0 through 36.0.6, 37.0.0 through 42.0.1, and 43.0.0 (all for the Rust crate). The vulnerability was published on April 9, 2026, by the Bytecode Alliance. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory, Wasmtime Advisory).

The root cause is a historical refactoring (PR #11254) that changed how compiled code referenced tables within table.* instructions but failed to update the corresponding Winch compiler code paths, leaving Winch using an incorrect indexing scheme (CWE-670: Always-Incorrect Control Flow Implementation, CWE-248: Uncaught Exception, CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input). When a guest WebAssembly module uses the table.fill instruction, Winch may reference a nonexistent table index, causing an unhandled panic in the host Rust runtime. The vulnerability is exploitable on any architecture where Winch is used as the compiler, and only affects users of the Winch compiler — users of the Cranelift compiler are not affected (GitHub Advisory, Wasmtime Advisory).

Successful exploitation allows a valid guest WebAssembly module to crash the Wasmtime host process via an unhandled panic, resulting in a complete denial-of-service condition for any service relying on that Wasmtime instance. There is no confidentiality or integrity impact on the host system beyond the availability disruption; however, a secondary effect is spec-incorrect behavior where the wrong table may be modified within the guest. The vulnerability has no lateral movement potential and does not expose sensitive data (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.014–0.018%, placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection signatures are available via Nessus (plugin 305828) and Qualys scanners (Feedly).

1. Identify target: Locate a service or application that accepts and compiles untrusted WebAssembly modules using Wasmtime with the Winch compiler enabled (versions 25.0.0–36.0.6, 37.0.0–42.0.1, or 43.0.0).
2. Craft malicious Wasm module: Create a valid WebAssembly binary that includes a table.fill instruction referencing a table index. The module must be spec-valid so it passes initial validation but triggers the incorrect indexing in Winch during compilation.
3. Submit module for compilation: Submit the crafted .wasm file to the target service through whatever interface accepts WebAssembly input (e.g., API endpoint, file upload, plugin system).
4. Trigger host panic: When Winch compiles the table.fill instruction, it uses the wrong indexing scheme, references a nonexistent table, and causes an unhandled Rust panic in the host process, crashing the Wasmtime runtime and denying service to legitimate users (GitHub Advisory, Wasmtime Advisory).

• Logs: Rust panic messages in application logs referencing Wasmtime's Winch compiler internals, particularly around table indexing or table.fill instruction handling; unexpected process termination events logged by the host OS or service manager (e.g., systemd).
• Process: Sudden crash or restart of the Wasmtime host process; repeated process restarts in a short time window suggesting repeated exploitation attempts.
• Network: Repeated submission of WebAssembly modules containing table.fill instructions from the same source IP, especially if the service crashes after each submission.

Upgrade Wasmtime to one of the patched versions: 36.0.7 (for the 25.0.0–36.x branch), 42.0.2 (for the 37.0.0–42.x branch), or 43.0.1 (for the 43.0.0 branch). There is no configuration-based workaround for users of the Winch compiler; switching to the Cranelift compiler is an alternative since it is not affected by this vulnerability. Until patching is complete, operators should restrict the execution of untrusted WebAssembly modules and implement strict input validation before compilation (GitHub Advisory, Wasmtime Advisory).

The Bytecode Alliance published a security advisory and blog post covering this and related Wasmtime vulnerabilities on April 9, 2026 (Bytecode Alliance). The advisory was credited to researchers "shumbo" and "alexcrichton." An openSUSE security announcement was also issued, indicating downstream Linux distribution packaging was updated to address the flaw (openSUSE). No significant social media controversy or broad media coverage has been observed beyond standard vulnerability tracking channels.