CVE-2026-34946
Denial-of-Service in Wasmtime Winch Compiler via table.fill Instruction
Publication date: 2026-04-09
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bytecodealliance | wasmtime | From 25.0.0 (inc) to 36.0.7 (exc) |
| bytecodealliance | wasmtime | From 37.0.0 (inc) to 42.0.2 (exc) |
| bytecodealliance | wasmtime | From 43.0.0 (inc) to 43.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-670 | The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes a denial-of-service (DoS) condition by allowing a valid WebAssembly guest module to trigger a host panic in the Wasmtime runtime's Winch compiler. It impacts availability but does not affect confidentiality or integrity.
Since the vulnerability only affects availability and does not lead to unauthorized access, data leakage, or data modification, it does not directly compromise compliance with standards focused on data protection such as GDPR or HIPAA.
However, availability is a component of many security frameworks, so organizations relying on Wasmtime with the vulnerable versions should consider the risk of service disruption in their compliance and risk management processes.
Can you explain this vulnerability to me?
CVE-2026-34946 is a vulnerability in the Wasmtime WebAssembly runtime's Winch compiler affecting versions from 25.0.0 up to before 36.0.7, 42.0.2, and 43.0.1. The issue stems from a historical refactoring that changed how compiled code references tables within the table.* instructions but failed to update the Winch compiler's code paths accordingly.
Because of this, the Winch compiler uses an incorrect indexing scheme when compiling the table.fill instruction. This flaw allows a valid WebAssembly guest module to cause the host to panic on any architecture, resulting in a denial-of-service (DoS) condition.
The vulnerability manifests either by causing the host to panic due to referencing nonexistent tables or by executing incorrect behavior that modifies the wrong table, which violates specification correctness.
How can this vulnerability impact me? :
This vulnerability impacts the availability of the Wasmtime runtime by allowing an attacker to cause a host panic, effectively resulting in a denial-of-service (DoS) condition.
An attacker can exploit this flaw remotely with low privileges and without user interaction, making it relatively easy to trigger the host panic.
The vulnerability does not affect confidentiality or integrity but can disrupt service availability by crashing the host process running Wasmtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to the Wasmtime runtime's Winch compiler and manifests as a host panic when compiling the table.fill instruction. Detection involves identifying if your system is running a vulnerable version of Wasmtime.
- Check the Wasmtime version installed on your system to see if it falls within the vulnerable ranges: >= 25.0.0 up to 36.0.6, >= 37.0.0 up to 42.0.1, or version 43.0.0.
- Use commands like `wasmtime --version` or check the package manager to determine the installed Wasmtime version.
- Monitor system logs for host panics or crashes related to Wasmtime processes, which may indicate exploitation attempts.
There are no specific network detection commands or signatures mentioned for this vulnerability, as exploitation requires compiling a WebAssembly guest module that triggers the panic.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Wasmtime to a patched version that fixes this vulnerability.
- Upgrade Wasmtime to version 36.0.7, 42.0.2, or 43.0.1 or later, as these versions include the fix for the vulnerability.
- If you are using the Winch compiler, there is no workaround other than upgrading.
- Users employing the Cranelift compiler are not affected by this issue.
After upgrading, monitor your systems for any unusual host panics or crashes to ensure the vulnerability is mitigated.