Is CVE-2026-34945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34945 being exploited in the wild.

How severe is CVE-2026-34945?

Medium severity, with a CVSS score of 6.5, published 9 April 2026.

Which products and versions are affected?

wasmtime (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1, SEMVER:introduced=25.0.0,fixed=36.0.7.

Is there a fix for CVE-2026-34945?

Yes. wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-34945?

Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34945: Wasmtime has host data leakage with 64-bit tables and Winch

CVE-2026-34945 · Severity: medium · CVSS 6.5 · Published 2026-04-09

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive data related to other host-originating operations which is not intended to be disclosed to guests. This bug specifically arose from a mistake where the return value of table.size was statically typed as a 32-bit integer, as opposed to consulting the table's index type to see how large the returned register could be. When combined with details about Wnich's ABI, such as multi-value returns, this can be combined to read stack data from the host, within a guest. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Technologies: Bytecodealliance Wasmtime, wasmtime (crates.io). Vendors: Bytecodealliance, crates.io.

Quick answers

Is CVE-2026-34945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34945 being exploited in the wild.
How severe is CVE-2026-34945?: Medium severity, with a CVSS score of 6.5, published 9 April 2026.
Which products and versions are affected?: wasmtime (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1, SEMVER:introduced=25.0.0,fixed=36.0.7.
Is there a fix for CVE-2026-34945?: Yes. wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-34945?: Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later
```
cargo update -p wasmtime
```

Affected products

Bytecodealliance Wasmtime
wasmtime (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1, SEMVER:introduced=25.0.0,fixed=36.0.7

Identifiers

CVE-2026-34945
GHSA-m9w2-8782-2946
RUSTSEC-2026-0086

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.