CVE-2026-34943

highpriority · track · 30EPSS 0.003 · 25 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.32% (25th) EPSS

CVSS 7.5 · high

Is it mine?

13 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into Val, not when using the flags! macro. This additionally only affects flags-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 1.7–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v4.05.6mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.05.6mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.01.7lowCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-248USCWE-248US

affected products (13)

Products and version ranges known to be affected.

bytecodealliance wasmtime≤ < 24.0.7enisa_euvdEU
bytecodealliance wasmtime25.0.0, → 36.0.7enisa_euvdEU
bytecodealliance wasmtime37.0.0, → 42.0.2enisa_euvdEU
bytecodealliance wasmtime43.0.0, → 44.0.1enisa_euvdEU
bytecodealliance wasmtime< 24.0.7nvdUScpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
bytecodealliance wasmtime25.0.0 → 36.0.7nvdUScpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
bytecodealliance wasmtime37.0.0 → 42.0.2nvdUScpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
bytecodealliance wasmtime43.0.0 → 43.0.1nvdUScpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*
crates.io wasmtime< 24.0.7osvUSpkg:cargo/wasmtime
crates.io wasmtime0.0.0-0 → 24.0.7osvUSpkg:cargo/wasmtime
crates.io wasmtime25.0.0 → 36.0.7osvUSpkg:cargo/wasmtime
crates.io wasmtime37.0.0 → 42.0.2osvUSpkg:cargo/wasmtime
crates.io wasmtime43.0.0 → 43.0.1osvUSpkg:cargo/wasmtime

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-m758-wjhj-p3jqWasmtime has a possible panic when lifting `flags` component value2026-04-09ghsa · osvUS
### Impact Wasmtime contains a possible panic which can happen when a `flags`-typed component model value is lifted with the `Val` type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This panic only affects wasmtime's implementation of lifting into `Val`, not when using the `flags!` macro. This additionally only affects `flags`-typed values which are part of a WIT interface. This has the risk of being a guest-controlled panic within the host which Wasmtime considers a DoS vector. ### Patches Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime. ### Workarounds There is no workaround for this bug if a host meets the criteria to be affected. To be affected a host must be using `wasmtime::component::Val` and possibly work with a `flags` type in the component model.
RUSTSEC-2026-0085Panic when lifting `flags` component value2026-04-09vendor · osvUS
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq For more information see the GitHub-hosted security advisory.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2026-04-09modified 2026-10-26

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan