CVE-2026-34943— Wasmtime panics when lifting `flags` component value
Quick assessment
Affected
bytecodealliance wasmtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于当使用Val类型提升标志类型组件模型值时，如果设置了组件模型指定范围之外的位，Wasmtime会在提升该值时发生恐慌，可能导致由访客控制的恐慌，构成拒绝服务向量。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-34943
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wasmtime panics when lifting `flags` component value
Source: CVE Program / CVE List V5
Vulnerability Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
wasmtime 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于当使用Val类型提升标志类型组件模型值时，如果设置了组件模型指定范围之外的位，Wasmtime会在提升该值时发生恐慌，可能导致由访客控制的恐慌，构成拒绝服务向量。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bytecodealliance | wasmtime | < 24.0.7 | - |
|
II. Public POCs for CVE-2026-34943
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34943
请登录查看更多情报信息。
Same Patch Batch · bytecodealliance · 2026-04-09 · 12 CVEs total
| CVE-2026-35195 | Wasmtime has an out-of-bounds write or crash when transcoding component model strings | |
| CVE-2026-35186 | Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backe | |
| CVE-2026-34983 | Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` | |
| CVE-2026-34941 | Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding | |
| CVE-2026-34942 | Wasmtime panics when transcoding misaligned utf-16 strings | |
| CVE-2026-34988 | Wasmtime leaks data between pooling allocator instances | |
| CVE-2026-34971 | Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift | |
| CVE-2026-34946 | Wasmtime's host panics when Winch compiler executes `table.fill` | |
| CVE-2026-34944 | Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 | |
| CVE-2026-34945 | Wasmtime leaks host data with 64-bit tables and Winch | |
| CVE-2026-34987 | Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access |
IV. Related Vulnerabilities
Same product: wasmtime
-
CVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms f -
CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation -
CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT -
CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o -
CVE-2026-35195
Wasmtime has an out-of-bounds write or crash when transcodin
Same vendor: bytecodealliance
-
CVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms f -
CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation -
CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT -
CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o -
CVE-2026-35195
Wasmtime has an out-of-bounds write or crash when transcodin
Same weakness: CWE-248
-
CVE-2026-77781
Tie::Hash::Regex versions before 2.0.0 for Perl will throw a -
CVE-2026-53530
ratex-parser panics on `\verb` with a multibyte delimiter (U -
CVE-2026-52731
ZEBRA: Full node denial of service via non-ASCII LongPollId -
CVE-2026-52738
ZEBRA: Finalized address balance credit-first overflow on co -
CVE-2026-52739
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Ze
V. Comments for CVE-2026-34943
No comments yet