CVE Explorer
CVE-2026-34941
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a vulnerability where when transcoding a UTF-16 string to the latin1+utf16 component-model encoding it would incorrectly validate the byte length of the input string when performing a bounds check. Specifically the number of code units were checked instead of the byte length, which is twice the size of the code units. This vulnerability can cause the host to read beyond the end of a WebAssembly'
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"wasmtime","vendor":"bytecodealliance","versions":[{"status":"affected","version":"< 24.0.7"},{"status":"affected","version":">= 25.0.0, < 36.0.7"},{"status":"affected","version":">= 37.0.0, < 42.0.2"},{"status":"affected","version":">= 43.0.0, < 44.0.1"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:ae2cc61a5e85738cba3d658c61f0c0fc0a3ded36e2aaa98a285f8f1d2c769289 · sha256:655a85e4522d1631… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:ae2cc61a5e85738cba3d658c61f0c0fc0a3ded36e2aaa98a285f8f1d2c769289 · sha256:655a85e4522d1631… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-125","description":"CWE-125: Out-of-bounds Read","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:ae2cc61a5e85738cba3d658c61f0c0fc0a3ded36e2aaa98a285f8f1d2c769289 · sha256:655a85e4522d1631… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:ae2cc61a5e85738cba3d658c61f0c0fc0a3ded36e2aaa98a285f8f1d2c769289 · sha256:655a85e4522d1631… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.