Buffer overflow in Bytecodealliance Wasmtime

CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated b…

Vulnerability class: Buffer Overflow

EPSS: 0.000 (1.9th percentile) — read the EPSS interpretation.

Affected products

Bytecodealliance Wasmtime — versions < 24.0.7, >= 25.0.0, < 36.0.7, >= 37.0.0, < 42.0.2

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm (x_refsource_CONFIRM)