CVE-2026-35195: Wasmtime Wasmtime Has Out-of-bounds Write Or Vulnerability

Q: What is CVE-2026-35195?

CVE-2026-35195 is a security vulnerability in Wasmtime involving Wasmtime has out-of-bounds write or crash when transcoding component model strings under CWE-787: Out-of-bounds Write.

Q: Which Wasmtime versions are affected?

Affected versions include releases prior to 24.0.7, 36.0.7, 42.0.2, 43.0.1 across affected packages: wasmtime.

Q: What version fixes CVE-2026-35195?

Upgrading to 24.0.7, 36.0.7, 42.0.2, 43.0.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is wasmtime affected?

Yes, wasmtime is affected in releases prior to 24.0.7, 36.0.7, 42.0.2, 43.0.1. Upgrade your dependency to 24.0.7, 36.0.7, 42.0.2, 43.0.1 or later.

Q: What CWE is associated with CVE-2026-35195?

CVE-2026-35195 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).

Q: How can I check crates.io dependencies for CVE-2026-35195?

Run the dependency tree command: 'inspect dependencies for wasmtime'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-394w-hwhg-8vgm

CWE-787

Published 2026-04-09

Advisory Summary

CVE-2026-35195 is a MODERATE wasmtime has out-of-bounds write or vulnerability (CWE-787: Out-of-bounds Write) affecting Wasmtime libraries in the crates.io ecosystem. The issue involves wasmtime has out-of-bounds write or crash when transcoding component model strings. Remediation is available by upgrading affected packages to version 24.0.7, 36.0.7, 42.0.2, 43.0.1.

CVE-2026-35195 at a Glance

CVE Identifier CVE-2026-35195

GHSA Identifier GHSA-394w-hwhg-8vgm

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-787: Out-of-bounds Write

Affected Product Wasmtime

Package Ecosystem crates.io

Published Date 2026-04-09

Last Updated 2026-04-10

How to Fix CVE-2026-35195

To remediate this vulnerability, upgrade all affected Wasmtime dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

wasmtime fixed: 24.0.7

Upgrade wasmtime to 24.0.7

wasmtime fixed: 36.0.7

Upgrade wasmtime to 36.0.7

wasmtime fixed: 42.0.2

Upgrade wasmtime to 42.0.2

wasmtime fixed: 43.0.1

Upgrade wasmtime to 43.0.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for wasmtime

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-35195, inspect your project dependencies for Wasmtime:

inspect dependencies for wasmtime

Analyze the terminal output to locate any version of Wasmtime in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 24.0.7), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-787: Out-of-bounds Write, where the product writes data past the end, or before the beginning, of the intended buffer. In Wasmtime, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's `realloc` is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no known workaround for this issue and affected hosts/embeddings are recommended to upgrade.

CVE-2026-35195 Affected Wasmtime Versions

4 component(s)

Fixed Versions:

24.0.736.0.742.0.243.0.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
wasmtime	crates.io	< 24.0.7	24.0.7
wasmtime	crates.io	≥ 25.0.0 < 36.0.7	36.0.7
wasmtime	crates.io	≥ 37.0.0 < 42.0.2	42.0.2
wasmtime	crates.io	≥ 43.0.0 < 43.0.1 All 1 versions 43.0.0	43.0.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm

NVD — CVE-2026-35195 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-35195

Wasmtime Source Repository REPOSITORY

https://github.com/bytecodealliance/wasmtime

rustsec.org/advisories/rustsec-... WEB

https://rustsec.org/advisories/RUSTSEC-2026-0091.html

Frequently Asked Questions

What is CVE-2026-35195?

CVE-2026-35195 is a security vulnerability in Wasmtime involving Wasmtime has out-of-bounds write or crash when transcoding component model strings under CWE-787: Out-of-bounds Write.

Which Wasmtime versions are affected?

Affected versions include releases prior to 24.0.7, 36.0.7, 42.0.2, 43.0.1 across affected packages: wasmtime.

What version fixes CVE-2026-35195?

Upgrading to 24.0.7, 36.0.7, 42.0.2, 43.0.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is wasmtime affected?

Yes, wasmtime is affected in releases prior to 24.0.7, 36.0.7, 42.0.2, 43.0.1. Upgrade your dependency to 24.0.7, 36.0.7, 42.0.2, 43.0.1 or later.

What CWE is associated with CVE-2026-35195?

CVE-2026-35195 is classified under CWE-787: Out-of-bounds Write (The product writes data past the end, or before the beginning, of the intended buffer.).

How can I check crates.io dependencies for CVE-2026-35195?

Run the dependency tree command: 'inspect dependencies for wasmtime'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-394w-hwhg-8vgm",
  "modified" : "2026-04-10T14:40:30Z",
  "published" : "2026-04-09T20:24:12Z",
  "aliases" : [ "CVE-2026-35195" ],
  "summary" : "Wasmtime has out-of-bounds write or crash when transcoding component model strings",
  "details" : "### Impact\n\nWasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's `realloc` is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration.\n\nWasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. \n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no known workaround for this issue and affected hosts/embeddings are recommended to upgrade.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "wasmtime"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "24.0.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "wasmtime"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "25.0.0"
      }, {
        "fixed" : "36.0.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "wasmtime"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "37.0.0"
      }, {
        "fixed" : "42.0.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "wasmtime"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "43.0.0"
      }, {
        "fixed" : "43.0.1"
      } ]
    } ],
    "versions" : [ "43.0.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-35195"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/bytecodealliance/wasmtime"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2026-0091.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-787" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-09T20:24:12Z",
    "nvd_published_at" : "2026-04-09T19:16:25Z"
  }
}

CVSS V4

N/A MODERATE

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Advisory Metadata

Source ID: GHSA-394w-hwhg-8vgm
Schema Version: 1.4.0
Published: 2026-04-09 20:24
Last Modified: 2026-04-10 14:40
Database Record File: advisories/github-reviewed/2026/04/GHSA-394w-hwhg-8vgm/GHSA-394w-hwhg-8vgm.json