{"id":"EUVD-2026-21031","enisaUuid":"adf22036-245f-3393-ad2f-8e89f19858f4","description":"Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler\u003dwinch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.","datePublished":"Apr 9, 2026, 6:48:33 PM","dateUpdated":"Apr 10, 2026, 2:12:55 PM","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83\n","aliases":"CVE-2026-34987\nGHSA-xx5w-cvp6-jv83\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"57b4303d-0613-39e6-97ab-abab004ea411","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.7"},{"id":"b6fe8a92-8c4c-3805-b8f6-69b14177507e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 44.0.1"},{"id":"cd9ecdcb-69c5-3669-8b59-319458dff0bb","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 42.0.2"}],"enisaIdVendor":[{"id":"2e8fe851-bdd0-35a2-a4f4-1cdafa167234","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"914b66ba-21a1-3a36-bbe4-9ea60bb21f72","vulnerability":{"id":"GHSA-xx5w-cvp6-jv83","description":"Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access","datePublished":"Apr 10, 2026, 3:31:18 PM","dateUpdated":"Apr 10, 2026, 3:31:18 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34987\nhttps://github.com/bytecodealliance/wasmtime\nhttps://rustsec.org/advisories/RUSTSEC-2026-0095.html\n","enisa_id":"EUVD-2026-21031\n","aliases":"CVE-2026-34987\nGHSA-xx5w-cvp6-jv83\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cad67f8d-1d51-3795-9a43-24c8ead4a16b","vulnerability":{"id":"CVE-2026-34987","description":"Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox. This vulnerability requires use of the Winch compiler (-Ccompiler\u003dwinch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice. This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.","datePublished":"Apr 9, 2026, 6:48:33 PM","dateUpdated":"Apr 10, 2026, 2:12:55 PM","status":"PUBLISHED","baseScore":9.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83\n","enisa_id":"EUVD-2026-21031\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"73e4d97e-6482-33c8-87b1-1c2834644a9e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"43.0.0, \u003c 44.0.1"},{"id":"7871e03a-ba99-3478-b1b8-a2304bc78640","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"25.0.0, \u003c 36.0.7"},{"id":"c6c3e997-c6f0-390c-b14b-8bc34d19409c","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"37.0.0, \u003c 42.0.2"}],"vulnerabilityVendor":[{"id":"2cb1656c-2ade-3acd-901f-1ca209a08730","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[{"id":"8be39175-affb-3da6-bd58-110364e6e525","advisory":{"id":"SUSE-SU-2026:21789-1","description":"Security update for tree-sitter","summary":"Security update for tree-sitter","datePublished":"May 14, 2026, 8:09:11 AM","dateUpdated":"Sep 29, 2026, 5:26:26 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21789-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202621789-1/\nhttps://lists.suse.com/pipermail/sle-updates/2026-May/046824.html\nhttps://bugzilla.suse.com/1259205\nhttps://bugzilla.suse.com/1261839\nhttps://bugzilla.suse.com/1261871\nhttps://bugzilla.suse.com/1261894\nhttps://bugzilla.suse.com/1261954\nhttps://bugzilla.suse.com/1261963\nhttps://bugzilla.suse.com/1261968\nhttps://bugzilla.suse.com/1261974\nhttps://bugzilla.suse.com/1262007\nhttps://bugzilla.suse.com/1262032\nhttps://bugzilla.suse.com/1262036\nhttps://bugzilla.suse.com/1262040\nhttps://www.suse.com/security/cve/CVE-2026-34941/\nhttps://www.suse.com/security/cve/CVE-2026-34942/\nhttps://www.suse.com/security/cve/CVE-2026-34943/\nhttps://www.suse.com/security/cve/CVE-2026-34944/\nhttps://www.suse.com/security/cve/CVE-2026-34945/\nhttps://www.suse.com/security/cve/CVE-2026-34946/\nhttps://www.suse.com/security/cve/CVE-2026-34987/\nhttps://www.suse.com/security/cve/CVE-2026-34988/\nhttps://www.suse.com/security/cve/CVE-2026-35186/\nhttps://www.suse.com/security/cve/CVE-2026-35195/\n","aliases":"CVE-2026-34941\nCVE-2026-34942\nCVE-2026-34943\nCVE-2026-34944\nCVE-2026-34945\nCVE-2026-34946\nCVE-2026-34987\nCVE-2026-34988\nCVE-2026-35186\nCVE-2026-35195\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"01851624-fbed-34f6-9177-ac59eb1400c0","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"07906a64-728b-3906-8470-06eec21f49a5","product":{"name":"libtree-sitter0_26-x86-64-v3-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0adb602e-605f-31b6-9117-e8ca784ce76a","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1400626c-30cd-3864-b6a9-182a4bd2358a","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"1bfa8258-0b70-350a-922e-f03fcadff58f","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"260a1a1f-8e03-3cea-a530-615e8402d236","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"27a1de74-ec6f-377b-aad0-9b332f66ab76","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"34c29c81-e91b-3d6e-8707-3a4d3c07c6e4","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4fcfd168-bbab-3b0d-a23c-1792516c9315","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5326f691-16a9-355c-85c5-7b2a36582150","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6436e314-1782-3074-81cc-940f870f1ee3","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"85635639-7159-394a-bb88-158aa7480119","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"8855c1ea-ad18-33fe-aa32-e0a6cbb4b5e1","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a499603f-86ad-302e-9800-f8754041ba23","product":{"name":"tree-sitter-devel-0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"af61517d-f993-3c93-9e39-72517f8c567c","product":{"name":"libtree-sitter0_26-x86-64-v3-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"af9e599c-9827-3038-abd3-810004e1db30","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"c4c02bfb-c8e2-3ed4-b881-64c43bf06b74","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d7b67c17-3cb9-3549-9e98-5384349bf65b","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"df66d873-e4be-3bf7-abb8-809f757392fc","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ea47a3c1-9419-37e6-b812-f3266e285a5a","product":{"name":"libtree-sitter0_26-0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"bd8ef2a3-a332-358b-a65b-4b5681cfe78a","advisory":{"id":"openSUSE-SU-2026:20749-1","description":"Security update for tree-sitter","summary":"Security update for tree-sitter","datePublished":"May 14, 2026, 8:07:53 AM","dateUpdated":"Sep 29, 2026, 5:31:22 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20749-1.json\nhttps://bugzilla.suse.com/1259205\nhttps://bugzilla.suse.com/1261839\nhttps://bugzilla.suse.com/1261871\nhttps://bugzilla.suse.com/1261894\nhttps://bugzilla.suse.com/1261954\nhttps://bugzilla.suse.com/1261963\nhttps://bugzilla.suse.com/1261968\nhttps://bugzilla.suse.com/1261974\nhttps://bugzilla.suse.com/1262007\nhttps://bugzilla.suse.com/1262032\nhttps://bugzilla.suse.com/1262036\nhttps://bugzilla.suse.com/1262040\nhttps://www.suse.com/security/cve/CVE-2026-34941/\nhttps://www.suse.com/security/cve/CVE-2026-34942/\nhttps://www.suse.com/security/cve/CVE-2026-34943/\nhttps://www.suse.com/security/cve/CVE-2026-34944/\nhttps://www.suse.com/security/cve/CVE-2026-34945/\nhttps://www.suse.com/security/cve/CVE-2026-34946/\nhttps://www.suse.com/security/cve/CVE-2026-34987/\nhttps://www.suse.com/security/cve/CVE-2026-34988/\nhttps://www.suse.com/security/cve/CVE-2026-35186/\nhttps://www.suse.com/security/cve/CVE-2026-35195/\n","aliases":"CVE-2026-34941\nCVE-2026-34942\nCVE-2026-34943\nCVE-2026-34944\nCVE-2026-34945\nCVE-2026-34946\nCVE-2026-34987\nCVE-2026-34988\nCVE-2026-35186\nCVE-2026-35195\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"05a5180b-019b-3bc0-842e-6e10b13980aa","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"091ff1ee-8d0a-3d7a-84a6-974ec06bdd61","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"186339de-7392-332c-ae2a-d52668025bf4","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2c4b7093-90ac-3e4b-a5f2-9c435c558dbc","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2f03a92a-d648-36bb-a099-32561164df42","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5181887b-e734-3865-a234-0646418c1be5","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"5a1f6f47-f16c-3430-b69c-16f6d8a833dc","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"60c9ec65-b40b-3a55-869e-d50306f09f2e","product":{"name":"libtree-sitter0_26-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6735312c-af30-39da-807a-5879276e3edb","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"689284a1-2e59-33c7-b34d-48b45bbccc44","product":{"name":"libtree-sitter0_26-x86-64-v3-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6b7ff6e6-bb5d-36c0-9731-9680609b3477","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"715c5727-93a3-3ae8-9fc7-d71e42c658fc","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8ceaa785-018b-3ca1-81bc-f8c1c47bb415","product":{"name":"tree-sitter-0:0.26.8-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"efd8df71-48e5-334f-a296-b9efdd95c089","product":{"name":"tree-sitter-devel-0:0.26.8-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}