GHSA-HX6P-XPX3-JVVV Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Summary Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte...

EUVD-2026-20988

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding...

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Summary Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte...

CVE-2026-34987

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch...

DEBIAN-CVE-2026-34987

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch baseline non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch...

CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

DEBIAN-CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

DEBIAN-CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This...

CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This...

CVE-2026-34988

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one instance to the next. The implementation of resetting the...

DEBIAN-CVE-2026-35186

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally i...

CVE-2026-34946

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a valid guest can be compiled with Winch, on any architecture...

amaranth-yosys (>=0.25.0.0.post61, <=0.25.0.0.post67), yowasp-runtime (>=1.7.0, <=1.12.0) potentially affected by CVE-2026-34983 via wasmtime (5.0.0)

wasmtime PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys =0.25.0.0.post61, =1.7.0, =1.12.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (>=0.40.0.0.post103, <=0.50.0.0.post105), checkrd (>=0.3.0, <=0.3.8) +1 more potentially affected by CVE-2026-34983 via wasmtime (29.0.0)

wasmtime PYPI version 29.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys =0.40.0.0.post103, =0.3.0, =0.3.8 - yowasp-runtime 1.69.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.38.0.0.post87), typegraph (>=0.3.5, <=0.3.6) +1 more potentially affected by CVE-2026-34983 via wasmtime (18.0.2)

wasmtime PYPI version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.38.0.0.post87 - typegraph =0.3.5, =0.3.6 - yowasp-runtime 1.52.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-1...

amaranth-yosys (0.50.0.0.post108), yowasp-runtime (1.71.0) potentially affected by CVE-2026-34983 via wasmtime (31.0.0)

wasmtime PYPI version 31.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.50.0.0.post108 - yowasp-runtime 1.71.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

PYSEC-2026-151

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following...

amaranth-yosys (0.25.0.0.post70), yowasp-runtime (1.19.0) potentially affected by CVE-2026-34983 via wasmtime (7.0.0)

wasmtime PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post70 - yowasp-runtime 1.19.0 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.10.0.dev46) potentially affected by CVE-2026-34983 via wasmtime (0.32.0)

wasmtime PYPI version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.10.0.dev46 Source cves: CVE-2026-34983 Source advisory: OSV:PYSEC-2026-151...

amaranth-yosys (0.25.0.0.post77), one-sdk (>=1.0.0b8, <=1.0.0b14) +2 more potentially affected by CVE-2026-34983 via wasmtime (13.0.2)

wasmtime PYPI version 13.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post77 - one-sdk =1.0.0b8, =0.2.2, =0.3.4 - yowasp-runtime 1.40.0 Source cves: CVE-2026-34983 Source advisory:...