dbcve.org
WasmtimeApplication · Bytecodealliance

CVE-2026-35186

HIGH · 7.5 CVSS v3.1 Published 2026-04-09
Fix available
A fix is available. Upgrade to 36.0.7 / 42.0.2 or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch's compiler state compounds into further issues depending on how the value is consumed. The primary consequence of this bug is that bytes in the host's address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of table.grow that can be misinterpreted is -1. The bytes before linear memory are, by default, unmapped memory. Wasmtime will detect this fault and abort the process, however, because wasm should not be able to access these bytes. Overall this this bug in Winch represents a DoS vector by crashing the host process, a correctness issue within Winch, and a possible leak of up to 16-bytes before linear memory. Wasmtime's default compiler is Cranelift, not Winch, and Wasmtime's default settings are to place guard pages before linear memory. This means that Wasmtime's default configuration is not affected by this issue, and when explicitly choosing Winch Wasmtime's otherwise default configuration leads to a DoS. Disabling guard pages before linear memory is required to possibly leak up to 16-bytes of host data. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Winch compiler backend in Wasmtime versions 25.0.0 through 36.0.7/42.0.2/43.0.0 incorrectly types the result of the table.grow operator as 64-bit instead of 32-bit for 32-bit tables. This causes the value -1 to be misinterpreted, potentially reading up to 16 bytes before linear memory. When guard pages are disabled (required for the leak), this results in DoS via process crash; with guard pages enabled (default), only a DoS occurs.

MitigationUpgrade to Wasmtime 36.0.7, 42.0.2, or 43.0.1, or continue using the default Cranelift compiler, or ensure guard pages before linear memory remain enabled.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
WasmtimeApplication
Affected:>= 25.0.0, < 36.0.7>= 37.0.0, < 42.0.2= 43.0.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Wasmtime version
    Run `wasmtime --version` or check the installed Wasmtime package/version
    Affected if The version falls within >= 25.0.0 and < 36.0.7, OR >= 37.0.0 and < 42.0.2, OR equals 43.0.0
  2. Determine if Winch compiler backend is in use
    Inspect the Wasmtime configuration or runtime flags for explicit selection of the Winch compiler (e.g., look for `--compile winch` or similar compiler selection parameters in your runtime configuration)
    Affected if Winch compiler backend is explicitly configured or is the default compiler in the affected version range
  3. Check guard page configuration
    Inspect the Wasmtime runtime configuration or environment for settings controlling memory guard pages (typically a flag like `--disable-guard-mem` or a config option `GuardMemory` set to false)
    Affected if Guard pages are explicitly disabled in the runtime configuration (the default setting has guard pages enabled)
  4. Verify table.grow usage in WebAssembly modules
    Analyze deployed WebAssembly modules for usage of the table.grow instruction, particularly on 32-bit table types
    Affected if WebAssembly modules using table.grow on 32-bit tables are executed with the affected Wasmtime version and Winch compiler

A user is affected if they run Wasmtime versions 25.0.0-36.0.7, 37.0.0-42.0.2, or 43.0.0 with the Winch compiler backend enabled and are executing WebAssembly modules that use the table.grow operator on 32-bit tables.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 36.0.7 / 42.0.2 or later
Fixed in 36.0.742.0.2
Interim mitigation

Upgrade to Wasmtime 36.0.7, 42.0.2, or 43.0.1, or continue using the default Cranelift compiler, or ensure guard pages before linear memory remain enabled.

Recommended fix High confidence

Wasmtime 43.0.1 (or latest stable version beyond 43.0.1)

  1. 1. Identify current Wasmtime version by checking your project's dependency manifest or running: cargo tree -p wasmtime (if using Cargo)
  2. 2. Verify if Winch compiler is explicitly enabled in your Wasmtime configuration (this is not the default)
  3. 3. Upgrade Wasmtime to version 43.0.1 (or the latest stable version) using your package manager: cargo update -p wasmtime or update your Cargo.toml version constraint to 43.0.1
  4. 4. If you cannot upgrade immediately and are using Winch, consider temporarily switching to the default Cranelift compiler as a mitigation
  5. 5. Verify the upgrade by rebuilding and testing your application
Caveat Upgrading Wasmtime may introduce breaking changes in other areas; review the changelog between your current version and 43.0.1. If using Winch compiler explicitly, ensure no configuration changes are needed for the fixed version.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Wasmtime Scoped from the published advisory
  • Consultation1.0 h
  • Implementation1.0 h
  • Testing2.0 h
  • Review / QA1.0 h
5.0 hours of engineering $860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,376.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-35186 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-35186 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data