CVE-2026-35186

OVERVIEW CVE-2026-35186 affects Wasmtime versions 25.0.0 through 36.0.6, 42.0.0-42.0.1, and 43.0.0. The vulnerability exists in Wasmtime's Winch compiler backend and involves incorrect type handling of the table.grow operator for 32-bit tables, where results are incorrectly tagged as 64-bit values instead of 32-bit. This type confusion can lead to unintended memory access in the host address space, though exploitation is limited to accessing 16 bytes before linear memory. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is primarily denial of service through host process crashes. While the vulnerability theoretically allows reading or writing up to 16 bytes of host memory preceding linear memory, Wasmtime's default configuration mitigates the risk significantly. The default Cranelift compiler is unaffected, and default guard pages before linear memory prevent exploitation in standard deployments. Only systems explicitly configured to use the Winch compiler without guard pages face potential data leakage. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00047 indicates minimal exploitation probability. No public exploit code is currently available. The relatively low community attention aligns with the limited practical impact given Wasmtime's default secure configuration.