Vulnerability in Bytecodealliance Wasmtime
CVE-2026-34943
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 31.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Bytecodealliance Wasmtime — versions < 24.0.7, >= 25.0.0, < 36.0.7, >= 37.0.0, < 42.0.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-34943?
- CVE-2026-34943 is a high-severity vulnerability in Bytecodealliance Wasmtime, classified under CWE-248. CVSS score: 7.5/10. Published 2026-04-09.
- How severe is CVE-2026-34943?
- High severity. CVSS v3 base score is 7.5 out of 10.