CVE Explorer

CVE-2026-34983

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3f23fc1dfc78d01f09e632a0ea578c728f31b5ccafb90f102cbfc439d88ad759

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"wasmtime","vendor":"bytecodealliance","versions":[{"status":"affected","version":">= 43.0.0, < 43.0.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a1659b380b3c1f9ea9b91d60912dd4acd392a6a2e9651fc3650c652c4db940b1 · sha256:54525ec578bd917f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","baseScore":1,"baseSeverity":"LOW","privilegesRequired":"HIGH","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:a1659b380b3c1f9ea9b91d60912dd4acd392a6a2e9651fc3650c652c4db940b1 · sha256:54525ec578bd917f… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-416","description":"CWE-416: Use After Free","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:a1659b380b3c1f9ea9b91d60912dd4acd392a6a2e9651fc3650c652c4db940b1 · sha256:54525ec578bd917f… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"tags":["exploit"],"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a1659b380b3c1f9ea9b91d60912dd4acd392a6a2e9651fc3650c652c4db940b1 · sha256:54525ec578bd917f… · /containers/adp/0/references/0

{"name":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a1659b380b3c1f9ea9b91d60912dd4acd392a6a2e9651fc3650c652c4db940b1 · sha256:54525ec578bd917f… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer