Executive brief
Wasmtime is a runtime used to execute WebAssembly code, often used to run untrusted code safely in isolated environments. A flaw in how it handles memory allocation for very large data tables can cause the entire host application to crash. This allows a user with the ability to provide WebAssembly modules to trigger a denial-of-service, potentially disrupting services or applications relying on the runtime.
Technical details
Wasmtime's on-demand instance allocator contains a vulnerability in its table allocation logic where checked arithmetic can result in a panic upon overflow. This is specifically exploitable when the 'memory64' WebAssembly proposal is enabled (which is the default), as it allows for 64-bit table sizes that can exceed the host's address space and trigger the overflow. An attacker who can provide a malicious WebAssembly module or component can trigger this panic during instantiation, leading to a denial-of-service of the host process. The pooling allocator is not affected as it enforces stricter limits on table sizes. The issue is resolved in versions 36.0.8, 43.0.2, and 44.0.1.
Affected products
- Bytecode Alliance Wasmtime 30.0.0 to 36.0.7, 37.0.0 to 43.0.1, 44.0.0
Timeline
- 2026-04-30: advisory: GitHub advisory published by maintainers
- 2026-05-14: disclosed: CVE published to NVD