Is CVE-2026-35186 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35186 being exploited in the wild.

How severe is CVE-2026-35186?

High severity, with a CVSS score of 7.5, published 9 April 2026.

Which products and versions are affected?

wasmtime (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1, SEMVER:introduced=25.0.0,fixed=36.0.7.

Is there a fix for CVE-2026-35186?

Yes. wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35186 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35186?

Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35186: Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler

CVE-2026-35186 · Severity: high · CVSS 7.5 · Published 2026-04-09

Wasmtime, a runtime for executing WebAssembly code, contains a flaw in its Winch compiler backend that can cause the application to crash or potentially leak small amounts of memory. This occurs when the system incorrectly handles memory expansion requests, leading to invalid memory access. While the default configuration is not vulnerable to data leaks, it can still be forced to crash, resulting in a denial of service.

Technologies: Bytecodealliance Wasmtime, wasmtime (crates.io). Vendors: Bytecodealliance, crates.io.

Quick answers

Is CVE-2026-35186 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35186 being exploited in the wild.
How severe is CVE-2026-35186?: High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?: wasmtime (crates.io) SEMVER:introduced=0.0.0-0,fixed=36.0.7,introduced=37.0.0,fixed=42.0.2,introduced=43.0.0,fixed=43.0.1, SEMVER:introduced=25.0.0,fixed=36.0.7.
Is there a fix for CVE-2026-35186?: Yes. wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35186 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35186?: Check whether you run Bytecodealliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 36.0.7, 43.0.1 or later
```
cargo update -p wasmtime
```

Technical details

A bug in the Winch compiler backend of Wasmtime causes the `table.grow` operator to return an incorrectly typed value. Specifically, for 32-bit tables, the result is internally tagged as a 64-bit value. If this result is subsequently used as an address for a load/store operation (such as when the return value is -1), the compiler may calculate an incorrect address, potentially accessing up to 16 bytes before the start of linear memory. In default configurations with guard pages, this results in a process crash (DoS); if guard pages are disabled, it may lead to a limited information leak. The vulnerability is fixed in versions 36.0.7, 42.0.2, and 43.0.1.

Affected products

Bytecode Alliance Wasmtime >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; 43.0.0

Identifiers

CVE-2026-35186
GHSA-f984-pcp8-v2p7
RUSTSEC-2026-0094

Timeline

2026-04-09: disclosed
2026-04-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.