Is CVE-2026-34983 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34983 being exploited in the wild.

How severe is CVE-2026-34983?

Medium severity, with a CVSS score of 5, published 9 April 2026.

Which products and versions are affected?

wasmtime (crates.io) = 43.0.0, SEMVER:introduced=43.0.0,fixed=43.0.1; wasmtime (PyPI) ECOSYSTEM:introduced=0,last_affected=43.0.0.

Is there a fix for CVE-2026-34983?

Yes. wasmtime (crates.io): upgrade to 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34983 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34983?

Check whether you run Bytecodealliance Wasmtime, wasmtime (crates.io) or wasmtime (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34983: Bytecode Alliance Wasmtime use-after-free in Linker cloning

CVE-2026-34983 · Severity: medium · CVSS 5 · Published 2026-04-09

Wasmtime is a runtime for executing WebAssembly code. A technical flaw in how the software handles internal memory when copying certain components can lead to a program crash (segmentation fault). This issue only affects developers using the Wasmtime library in their own applications and does not allow external users or malicious WebAssembly programs to steal data or corrupt the system.

Technologies: Bytecodealliance Wasmtime, wasmtime (crates.io), wasmtime (PyPI). Vendors: Bytecodealliance, crates.io, PyPI.

Quick answers

Is CVE-2026-34983 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34983 being exploited in the wild.
How severe is CVE-2026-34983?: Medium severity, with a CVSS score of 5, published 9 April 2026.
Which products and versions are affected?: wasmtime (crates.io) = 43.0.0, SEMVER:introduced=43.0.0,fixed=43.0.1; wasmtime (PyPI) ECOSYSTEM:introduced=0,last_affected=43.0.0.
Is there a fix for CVE-2026-34983?: Yes. wasmtime (crates.io): upgrade to 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34983 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34983?: Check whether you run Bytecodealliance Wasmtime, wasmtime (crates.io) or wasmtime (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 43.0.1 or later
```
cargo update -p wasmtime
```

Technical details

A use-after-free vulnerability exists in the wasmtime crate version 43.0.0 due to an unsound implementation of the internal StringPool's cloning logic. The issue is triggered when an embedder clones a wasmtime::Linker instance, drops the original, and subsequently attempts to use the cloned instance. This occurs because the cloned linker retains references to memory owned by the original instance's interning pool. The vulnerability is not reachable by guest WebAssembly programs and typically results in a process crash (segfault) rather than heap corruption or data exfiltration. The issue was fixed in version 43.0.1 by correcting the interning pool's cloning behavior.

Affected products

Bytecode Alliance wasmtime 43.0.0

Identifiers

CVE-2026-34983
GHSA-hfr4-7c6c-48w2
PYSEC-2026-151
RUSTSEC-2026-0090

Timeline

2026-04-09: disclosed
2026-04-09: advisory
2026-04-09: patched: Patched in version 43.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.