Is CVE-2026-34945 actively exploited?

CVE-2026-34945 has no public evidence of in-the-wild exploitation as of 2026-04-20.

What is the CVSS score for CVE-2026-34945?

CVE-2026-34945 has a CVSS score of 2.3 (LOW severity). Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

How do I patch CVE-2026-34945?

Patch guidance is available from bytecodealliance security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-34945.

CVE-2026-34945 - remediation guidance & executive summary

Q: Which products are affected by CVE-2026-34945?

3 products: bytecodealliance wasmtime, bytecodealliance wasmtime, bytecodealliance wasmtime.

Description

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

CVSS Metrics

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Confidentiality: undefined
Integrity: undefined
Availability: undefined
Weaknesses: CWE-681

Metadata

Primary Vendor: BYTECODEALLIANCE
Published: 4/9/2026
Last Modified: 4/20/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

bytecodealliance : wasmtimebytecodealliance : wasmtimebytecodealliance : wasmtime

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-34945. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-34945

View on NIST NVD

CVE-2026-34945 vulnerability