CVE-2026-34945

OVERVIEW CVE-2026-34945 affects Wasmtime, a WebAssembly runtime, in versions 25.0.0 through 36.0.6, 42.0.1, and 43.0.0. The Winch compiler contains a logic error in translating the table.size instruction for 64-bit tables under WebAssembly's memory64 proposal. The defect stems from incorrectly treating the return value as a fixed 32-bit integer rather than consulting the table's actual index type, enabling information disclosure from the host's stack to WebAssembly guest environments. SEVERITY This vulnerability carries a CVSS score of 6.5 (Medium) with a network attack vector, low complexity, and no special privileges required for exploitation. The primary impact is confidentiality loss, as sensitive host stack data could be disclosed to untrusted WebAssembly guests. The exploitation leverages the Winch compiler's ABI details around multi-value returns to read arbitrary stack memory, though integrity and availability are not affected. Patches are available in versions 36.0.7, 42.0.2, and 43.0.1. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The EPSS score of 0.00012 indicates this vulnerability ranks below 0.018 percent of all CVEs in exploitation probability. No public exploit code has been disclosed, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. Community attention remains minimal, reflecting the specialized nature of the affected technology and the presence of readily available patches.