CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
Description
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.
INFO
Published Date :
April 9, 2026, 7:16 p.m.
Last Modified :
Oct. 26, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Update Wasmtime to version 36.0.7 or later.
- Update Wasmtime to version 42.0.2 or later.
- Update Wasmtime to version 43.0.1 or later.
Public PoC/Exploit Available at Github
CVE-2026-34987 has a 2 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-34987.
| URL | Resource |
|---|---|
| https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 | Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-34987 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-34987
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Rust-native LLM orchestration runtime — async task definition with LLM call primitives, Valkey-backed state persistence, at-least-once execution guarantees. Uses rig-core + valkey-glide. Fills gap #1 from landscape analysis: no Rust-native LLM orchestration SDK exists.
Rust
Dynamic and static analysis with Real Time Malware Analysis with Antivirus for Windows, including open-source XDR (3 EDR projects), ClamAV, YARA-X, machine learning AI, behavioral analysis, Unpacker, Deobfuscator, Decompiler, website signatures, Ghidra, Suricata, Sigma, Kernel, Hypervisior based protection and much more than you can imagine.
antivirus open-source-antivirus antimalware antivirus-software malware-analysis malware-research local-antivirus xdr edr
YARA Python Batchfile Inno Setup Java C++ C# HTML Roff TypeScript
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-34987 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-34987 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: wasmtime de bytecodealliance, Description: Wasmtime es un entorno de ejecución para WebAssembly. Desde la versión 25.0.0 hasta antes de las versiones 36.0.7, 42.0.2 y 43.0.1, Wasmtime con su backend de compilador Winch (línea base) no predeterminado puede permitir que un Wasm invitado correctamente construido acceda a la memoria del host fuera de su sandbox de memoria lineal. Esta vulnerabilidad requiere el uso del compilador Winch (-Ccompiler=winch). Por defecto, Wasmtime utiliza su backend Cranelift, no Winch. Con Winch, la misma suposición incorrecta está presente en teoría tanto en aarch64 como en x86-64. El caso de aarch64 tiene una prueba de concepto observada y funcional, mientras que el caso de x86-64 es teórico y puede no ser alcanzable en la práctica. Este error del compilador Winch puede permitir que el Wasm invitado acceda a la memoria antes o después de la región de memoria lineal, independientemente de si las regiones de pre-guardia o post-guardia están configuradas. El rango accesible en la prueba de concepto inicial del error es de hasta 32 KiB antes del inicio de la memoria, o ~4 GiB después del inicio de la memoria, independientemente del tamaño de las regiones de pre-guardia o post-guardia o del uso de comprobación de límites explícita o basada en regiones de guardia. Sin embargo, el error subyacente asume que un desplazamiento de memoria de 32 bits almacenado en un registro de 64 bits tiene sus bits superiores borrados cuando puede que no sea así, y por lo tanto, variantes estrechamente relacionadas de la prueba de concepto inicial pueden ser capaces de acceder a memoria verdaderamente arbitraria dentro del proceso. Esto podría resultar en una falla de segmentación del proceso host (DoS), una fuga de datos arbitraria del proceso host, o con una escritura, potencialmente una RCE arbitraria. Esta vulnerabilidad está corregida en las versiones 36.0.7, 42.0.2 y 43.0.1. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'bytecodealliance', 'product': 'wasmtime', 'versions': [{'status': 'affected', 'version': '>= 25.0.0, < 36.0.7'}, {'status': 'affected', 'version': '>= 37.0.0, < 42.0.2'}, {'status': 'affected', 'version': '>= 43.0.0, < 44.0.1'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-34987', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-10T14:12:37.362283Z'} -
Initial Analysis by [email protected]
Apr. 15, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* versions from (including) 25.0.0 up to (excluding) 36.0.7 *cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* versions from (including) 37.0.0 up to (excluding) 42.0.2 *cpe:2.3:a:bytecodealliance:wasmtime:43.0.0:*:*:*:*:rust:*:* Added Reference Type GitHub, Inc.: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 Types: Vendor Advisory -
New CVE Received by [email protected]
Apr. 09, 2026
Action Type Old Value New Value Added Description Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-125 Added CWE CWE-787 Added Reference https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83