CVE-2026-35195

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35195", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-01T18:48:58.936Z", "datePublished": "2026-04-09T18:55:56.467Z", "dateUpdated": "2026-04-13T15:38:27.294Z"}, "containers": {"cna": {"title": "Wasmtime has an out-of-bounds write or crash when transcoding component model strings", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm"}], "affected": [{"vendor": "bytecodealliance", "product": "wasmtime", "versions": [{"version": "< 24.0.7", "status": "affected"}, {"version": ">= 25.0.0, < 36.0.7", "status": "affected"}, {"version": ">= 37.0.0, < 42.0.2", "status": "affected"}, {"version": ">= 43.0.0, < 44.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T18:55:56.467Z"}, "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."}], "source": {"advisory": "GHSA-394w-hwhg-8vgm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T15:06:03.995539Z", "id": "CVE-2026-35195", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:38:27.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35195", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:06:03.995539Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:33:29.878Z"}}], "cna": {"title": "Wasmtime has an out-of-bounds write or crash when transcoding component model strings", "source": {"advisory": "GHSA-394w-hwhg-8vgm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "bytecodealliance", "product": "wasmtime", "versions": [{"status": "affected", "version": "< 24.0.7"}, {"status": "affected", "version": ">= 25.0.0, < 36.0.7"}, {"status": "affected", "version": ">= 37.0.0, < 42.0.2"}, {"status": "affected", "version": ">= 43.0.0, < 44.0.1"}]}], "references": [{"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm", "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T18:55:56.467Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35195", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:38:27.294Z", "dateReserved": "2026-04-01T18:48:58.936Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T18:55:56.467Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wasmtime", "vendor": "bytecodealliance", "versions": [{"status": "affected", "version": "< 24.0.7"}, {"status": "affected", "version": ">= 25.0.0, < 36.0.7"}, {"status": "affected", "version": ">= 37.0.0, < 42.0.2"}, {"status": "affected", "version": ">= 43.0.0, < 44.0.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*", "matchCriteriaId": "5A39DBFB-CD5E-4551-8885-053DF90E277A", "versionEndExcluding": "24.0.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*", "matchCriteriaId": "B5AB2157-3977-49F9-9058-6B16A2556170", "versionEndExcluding": "36.0.7", "versionStartIncluding": "25.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*", "matchCriteriaId": "1D7B70EB-93E3-4732-AB70-E6A531178941", "versionEndExcluding": "42.0.2", "versionStartIncluding": "37.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:43.0.0:*:*:*:*:rust:*:*", "matchCriteriaId": "9AD0150A-FE79-4EA6-995B-8CAFC7F246B5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1."}, {"lang": "es", "value": "Wasmtime es un entorno de ejecuci\u00f3n para WebAssembly. Antes de las versiones 24.0.7, 36.0.7, 42.0.2 y 43.0.1, la implementaci\u00f3n de Wasmtime para la transcodificaci\u00f3n de cadenas entre componentes contiene un error donde el valor de retorno de un realloc de un componente invitado no se valida antes de que el anfitri\u00f3n intente escribir a trav\u00e9s del puntero. Esto permite a un invitado hacer que el anfitri\u00f3n escriba bytes de cadena transcodificados arbitrarios en una ubicaci\u00f3n arbitraria hasta 4 GiB de distancia de la base de la memoria lineal. Estas escrituras en el anfitri\u00f3n podr\u00edan acceder a memoria no mapeada o podr\u00edan corromper estructuras de datos del anfitri\u00f3n, dependiendo de la configuraci\u00f3n de Wasmtime. Wasmtime, por defecto, reserva 4 GiB de memoria virtual para la memoria lineal de un invitado, lo que significa que este error, por defecto en los anfitriones, har\u00e1 que el anfitri\u00f3n acceda a memoria no mapeada y aborte el proceso debido a un fallo no manejado. Sin embargo, Wasmtime puede configurarse para reservar menos memoria para un invitado y para eliminar todas las p\u00e1ginas de protecci\u00f3n, por lo que algunas configuraciones de Wasmtime pueden llevar a la corrupci\u00f3n de datos fuera de la memoria lineal de un invitado, como estructuras de datos del anfitri\u00f3n o memorias lineales de otros invitados. Esta vulnerabilidad est\u00e1 corregida en las versiones 24.0.7, 36.0.7, 42.0.2 y 43.0.1."}], "id": "CVE-2026-35195", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35195", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T15:06:03.995539Z", "version": "2.0.3"}}]}, "published": "2026-04-09T19:16:25.500", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Wasmtime: Wasmtime: Data corruption and potential arbitrary code execution via unvalidated memory reallocation", "id": "2456994", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456994"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Wasmtime, a runtime for WebAssembly. A malicious guest component can exploit an issue where the host does not validate memory allocation requests. This allows the guest to write arbitrary data to locations outside its designated memory. Depending on the configuration, this could lead to corruption of critical host data or other guest environments, potentially resulting in information disclosure or the execution of unauthorized code."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-35195", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhcl-1-3-wasm-shim", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "virt-firmware-rs", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-04-09T18:55:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-35195\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35195\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,24.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,36.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[37.0.0,42.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[43.0.0,44.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wasmtime", "source": "cna", "vendor": "bytecodealliance"}, "product": "wasmtime", "vendor": "bytecodealliance"}], "analysis": {"en": {"generated_at": "2026-04-09T21:05:20.554272+00:00", "value": {"mitigation_remediation": ["Upgrade Wasmtime to version\u202f24.0.7,\u202f36.0.7,\u202f42.0.2,\u202f43.0.1, or any later release that contains the fix."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary memory write"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Wasmtime runtime provided by Bytecode Alliance. All releases before version\u202f24.0.7,\u202f36.0.7,\u202f42.0.2, and\u202f43.0.1 are impacted. The fix is available in those exact versions and any later maintenance releases.", "description_and_impact": "Wasmtime\u2019s implementation of string transcoding between components fails to validate the memory address returned by a guest component\u2019s realloc function. This flaw allows a malicious guest to cause the host to write arbitrary transcoded string bytes to a location anywhere up to 4\u202fGiB away from the base of linear memory. The resulting out\u2011of\u2011bounds write can corrupt host data structures, other guests\u2019 memories, or trigger an unhandled fault that aborts the process. Such corruption or crash can enable arbitrary code execution or lead to denial of service.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a medium severity. The exploit relies on a guest WebAssembly component that can invoke the vulnerable reclamation logic, so an attacker must be able to supply and load a malicious component into the Wasmtime host. Hosts configured with the default 4\u202fGiB guest memory and guard pages will typically crash the process, while hosts reducing the reserved memory or disabling guard pages may suffer data corruption, potentially enabling remote code execution. No known public exploits exist and the vulnerability is not listed in the KEV catalog; however organizations running unpatched Wasmtime versions should consider the risk significant due to the potential impact on host integrity."}}}}, "created": "2026-04-10T08:39:06.911052+00:00", "updated": "2026-04-10T09:29:51.196192+00:00", "vendors": ["bytecodealliance", "bytecodealliance$PRODUCT$wasmtime"]}