CVE-2026-35195: 
Rust vulnerability analysis and mitigation

CVE-2026-35195 is an out-of-bounds write vulnerability in Wasmtime, a WebAssembly runtime developed by the Bytecode Alliance, affecting its component model string transcoding implementation. The flaw was published on April 9, 2026, and affects Wasmtime versions prior to 24.0.7, versions 25.0.0 through 36.0.6, versions 37.0.0 through 42.0.1, and version 43.0.0. It carries a CVSS v4 base score of 6.1 (Medium) and a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Wasmtime Advisory).

The root cause is an out-of-bounds write (CWE-787) in Wasmtime's string transcoding logic for the WebAssembly Component Model. When a guest component's realloc function returns a pointer, the host does not validate that pointer before writing transcoded string bytes through it. A malicious or compromised guest component can therefore cause the host to write arbitrary bytes to any memory location up to 4 GiB away from the base of the guest's linear memory. Exploitation requires low privileges (the ability to run a guest component) and specific deployment conditions — namely, a Wasmtime configuration with reduced virtual memory reservations or disabled guard pages — making it more dangerous in non-default configurations (GitHub Advisory, Wasmtime Advisory).

In Wasmtime's default configuration, which reserves 4 GiB of virtual memory per guest, exploitation typically causes the host process to write to unmapped memory and abort due to an unhandled fault, resulting in a denial of service. In non-default configurations where memory reservations are reduced or guard pages are removed, the vulnerability can lead to corruption of host data structures or other guests' linear memories, with potential for limited confidentiality and integrity impacts. The vulnerability is sandboxed to the vulnerable system and does not affect subsequent systems in the default configuration (GitHub Advisory, Wasmtime Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.012% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to control a guest WebAssembly component and depends on specific Wasmtime configuration settings to achieve impact beyond process abort.

1. Identify a target: Locate a service or application running a vulnerable version of Wasmtime (prior to 24.0.7, 36.0.7, 42.0.2, or 43.0.1) that accepts and executes guest WebAssembly components, particularly those using the Component Model with string transcoding.
2. Craft a malicious guest component: Develop a WebAssembly component that implements a realloc function returning an out-of-bounds or crafted pointer value rather than a valid allocation within the guest's linear memory.
3. Trigger string transcoding: Cause the host to invoke string transcoding between components (e.g., by passing strings across component boundaries), which triggers the host to call the guest's realloc and then write transcoded bytes through the unvalidated returned pointer.
4. Achieve impact: In default configurations, the write to unmapped memory causes the host process to crash (denial of service). In configurations with reduced memory reservations or no guard pages, the write may corrupt host data structures or other guests' linear memories, potentially enabling further exploitation (GitHub Advisory, Wasmtime Advisory).

• Process: Unexpected crashes or aborts of the Wasmtime host process, particularly with signals related to memory access violations (e.g., SIGSEGV, SIGBUS on Linux) during WebAssembly component string transcoding operations.
• Logs: Application or system logs showing unhandled faults or segmentation faults originating from the Wasmtime runtime process, especially when processing inter-component string data.
• File System: Core dump files generated by the Wasmtime host process following an unexpected abort, which may indicate exploitation attempts in default configurations.

Upgrade Wasmtime to one of the patched versions: 24.0.7, 36.0.7, 42.0.2, or 43.0.1, depending on the version branch in use. There is no known configuration-based workaround; the vendor explicitly states that affected hosts and embeddings should upgrade. As an interim risk-reduction measure, ensure Wasmtime is running with its default memory configuration (4 GiB virtual memory reservation with guard pages enabled), as this limits exploitation to process abort rather than data corruption (GitHub Advisory, Wasmtime Advisory).

The Bytecode Alliance published a security advisory blog post covering this and related Wasmtime vulnerabilities shortly after disclosure (Bytecode Alliance). The advisory was credited to alexcrichton, a prominent Wasmtime contributor. No significant broader media coverage or notable community controversy has been observed, consistent with the moderate severity rating and absence of active exploitation.