CVE-2026-34987

Workaround

There are no workarounds within the Winch compiler backend while using the affected versions. Users of Wasmtime are encouraged either to upgrade to patched versions or, if that is not possible, use the Cranelift compiler backend.

Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-memory sandbox.

This vulnerability requires use of the Winch compiler (-Ccompiler=winch). By default, Wasmtime uses its Cranelift backend, not Winch. With Winch, the same incorrect assumption is present in theory on both aarch64 and x86-64. The aarch64 case has an observed-working proof of concept, while the x86-64 case is theoretical and may not be reachable in practice.

This Winch compiler bug can allow the Wasm guest to access memory before or after the linear-memory region, independently of whether pre- or post-guard regions are configured. The accessible range in the initial bug proof-of-concept is up to 32KiB before the start of memory, or ~4GiB after the start of memory, independently of the size of pre- or post-guard regions or the use of explicit or guard-region-based bounds checking. However, the underlying bug assumes a 32-bit memory offset stored in a 64-bit register has its upper bits cleared when it may not, and so closely related variants of the initial proof-of-concept may be able to access truly arbitrary memory in-process. This could result in a host process segmentation fault (DoS), an arbitrary data leak from the host process, or with a write, potentially an arbitrary RCE.

A read operation accesses a memory location beyond the intended buffer boundary. Typical impact: sensitive data disclosure or crash.

Kodem intelligence

Wasmtime 43.0.1, 42.0.2, and 36.0.7 have been released with fixes for this issue.

1. What is CVE-2026-34987? CVE-2026-34987 is a critical-severity out-of-bounds read vulnerability in wasmtime (rust), affecting versions >= 25.0.0, < 36.0.7. It is fixed in 36.0.7, 42.0.2, 43.0.1. A read operation accesses a memory location beyond the intended buffer boundary.
2. Which versions of wasmtime are affected by CVE-2026-34987? wasmtime (rust) versions >= 25.0.0, < 36.0.7 is affected.
3. Is there a fix for CVE-2026-34987? Yes. CVE-2026-34987 is fixed in 36.0.7, 42.0.2, 43.0.1. Upgrade to this version or later.
4. Is CVE-2026-34987 exploitable, and should I be worried? Whether CVE-2026-34987 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-34987 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-34987?
   • Upgrade wasmtime to 36.0.7 or later
   • Upgrade wasmtime to 42.0.2 or later
   • Upgrade wasmtime to 43.0.1 or later