Executive brief
Wasmtime, a runtime for executing WebAssembly code, contains a flaw in its Winch compiler backend that can cause the application to crash or potentially leak small amounts of memory. This occurs when the system incorrectly handles memory expansion requests, leading to invalid memory access. While the default configuration is not vulnerable to data leaks, it can still be forced to crash, resulting in a denial of service.
Technical details
A bug in the Winch compiler backend of Wasmtime causes the `table.grow` operator to return an incorrectly typed value. Specifically, for 32-bit tables, the result is internally tagged as a 64-bit value. If this result is subsequently used as an address for a load/store operation (such as when the return value is -1), the compiler may calculate an incorrect address, potentially accessing up to 16 bytes before the start of linear memory. In default configurations with guard pages, this results in a process crash (DoS); if guard pages are disabled, it may lead to a limited information leak. The vulnerability is fixed in versions 36.0.7, 42.0.2, and 43.0.1.
Affected products
- Bytecode Alliance Wasmtime >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; 43.0.0
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory