{"id":"EUVD-2026-21029","enisaUuid":"5d1e597d-9930-31f2-9e09-8a62dc90eafe","description":"Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.","datePublished":"Apr 9, 2026, 6:47:26 PM","dateUpdated":"Apr 13, 2026, 3:38:33 PM","baseScore":1.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2\n","aliases":"CVE-2026-34983\nGHSA-hfr4-7c6c-48w2\n","assigner":"GitHub_M","epss":0.12,"enisaIdProduct":[{"id":"a50c2126-8334-3f76-9a15-144e78ffbe4f","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 43.0.1"}],"enisaIdVendor":[{"id":"b18a99c3-9a1d-3890-8207-9af8af5c7954","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"4afbcc07-ccc8-3976-b810-88f3364f9b0e","vulnerability":{"id":"PYSEC-2026-151","description":"Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.","datePublished":"Apr 9, 2026, 7:16:24 PM","dateUpdated":"May 21, 2026, 2:54:48 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2\n","enisa_id":"EUVD-2026-21029\n","aliases":"CVE-2026-34983\nGHSA-hfr4-7c6c-48w2\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:05:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8e459039-0d02-3568-a044-e7a8a07344bc","vulnerability":{"id":"GHSA-hfr4-7c6c-48w2","description":"Wasmtime has use-after-free bug after cloning `wasmtime::Linker`","datePublished":"Apr 9, 2026, 8:23:44 PM","dateUpdated":"Jun 8, 2026, 8:00:38 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34983\nhttps://github.com/bytecodealliance/wasmtime\nhttps://github.com/pypa/advisory-database/tree/main/vulns/wasmtime/PYSEC-2026-151.yaml\nhttps://rustsec.org/advisories/RUSTSEC-2026-0090.html\n","enisa_id":"EUVD-2026-21029\n","aliases":"CVE-2026-34983\nGHSA-hfr4-7c6c-48w2\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c4787328-12e9-3f15-9ea4-7de8415446bd","vulnerability":{"id":"CVE-2026-34983","description":"Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.","datePublished":"Apr 9, 2026, 6:47:26 PM","dateUpdated":"Apr 13, 2026, 3:38:33 PM","status":"PUBLISHED","baseScore":1.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2\n","enisa_id":"EUVD-2026-21029\n","assigner":"GitHub_M","epss":0.12,"dataProcessed":"Oct 30, 2026, 7:19:03 AM","vulnerabilityProduct":[{"id":"3f604a1d-db17-3ab7-8257-350e2212c376","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 43.0.1"}],"vulnerabilityVendor":[{"id":"8af2fadf-aca9-3c87-adab-f22ec5a8e514","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}