CVE-2026-34987

OVERVIEW CVE-2026-34987 affects Wasmtime, a WebAssembly runtime, across versions 25.0.0 through 36.0.6, 42.0.1, and 43.0.0. The vulnerability exists specifically in Wasmtime's non-default Winch compiler backend and allows properly crafted WebAssembly guests to escape the linear-memory sandbox and access host memory outside intended boundaries. This affects both aarch64 and x86-64 architectures, though aarch64 has a confirmed working proof of concept while x86-64 remains theoretical. Administrators should note that systems using Wasmtime's default Cranelift backend are not affected. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.9 (Critical) with network attack vector, low attack complexity, and low privileges required. The impact is severe across all three dimensions: confidentiality, integrity, and availability. Potential consequences include host process denial of service through segmentation faults, arbitrary data exfiltration from host memory, and potentially arbitrary remote code execution if exploitation includes write capabilities. The underlying bug involves incorrect assumptions about 32-bit memory offsets stored in 64-bit registers, potentially allowing access to 32KiB before memory start or approximately 4GiB after it, with variants possibly accessing truly arbitrary in-process memory. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with the vulnerability marked as inactive on threat intelligence lists and not included in known exploited vulnerabilities databases. However, a working proof of concept exists for the aarch64 architecture, demonstrating technical feasibility. The vulnerability has received moderate community attention as reflected in its FAUCET Risk Score of 55.0/100. Patches are available in versions 36.0.7, 42.0.2, and 43.0.1, and organizations using the Winch compiler should prioritize updates immediately.