CVE-2026-44216
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Wasmtime versions 30.0.0 through 36.0.8, 43.0.2, and 44.0.1 contain a vulnerability where allocation logic for WebAssembly tables panics on overflow. This panic can be triggered when allocating extremely large tables (64-bit range via memory64 proposal). An attacker can cause a denial of service by providing a WebAssembly module or component that requests such a large table.
Risk Assessment
The vulnerability allows an attacker to crash the Wasmtime process (panic), leading to denial of service in production environments using this runtime.
Recommendation
Upgrade Wasmtime to version 36.0.8, 43.0.2, or 44.0.1 immediately. If upgrade is not possible, restrict loading untrusted WebAssembly modules with large tables.
Other vulnerabilities in Wasmtime
See all- CVE-2026-58494Medium
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1, the wasmtime-wasi component checked directory permissions but not matching FilePerms on source and destination preopens during hard-link creation and renaming. This allowed a WASI guest with read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces.
- CVE-2026-54786Medium
Wasmtime prior to versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2 contains a vulnerability in the native WASIp1 implementation where the fd_renumber function fails to properly close the target file descriptor. This causes resource leaks in the host system, potentially leading to exhaustion of file descriptors and resources.
- CVE-2026-47261High
Wasmtime, a runtime for WebAssembly, has a vulnerability in versions prior to 24.0.9, 36.0.10, and 44.0.2 that allows bypassing the access control mechanism using the wasip2 descriptor.open-at or wasip1 path_open interfaces. The issue arises from a missing assignment in the open mode handling, allowing files to be opened with the OpenFlags::TRUNCATE flag without the necessary write permissions.
- CVE-2026-34971High
Wasmtime versions 32.0.0 through 36.0.7, 42.0.2, and 43.0.1 have a bug in the Cranelift compiler on aarch64 that miscalculates memory addresses during heap access. This allows WebAssembly modules to bypass bounds checks and access arbitrary host memory, resulting in a sandbox escape.
Original NVD description (English source)
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.