{"schema_version":1,"title":"Bytecodealliance Wasmtime vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Bytecodealliance Wasmtime: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-35195, was published on 9 April 2026.","url":"https://junglewise.ai/threats/technologies/bytecodealliance-wasmtime","json_url":"https://junglewise.ai/threats/technologies/bytecodealliance-wasmtime.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/bytecodealliance-wasmtime","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":4,"all_time":12,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":11},"latest":[{"cve":"CVE-2026-35195","cvss":5.4,"epss":0.0022,"slug":"cve-2026-35195-bytecode-alliance-wasmtime-out-of-bounds-write-in-string","title":"Bytecode Alliance Wasmtime out-of-bounds write in string transcoding","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:25.5+00:00","url":"https://junglewise.ai/threats/cve-2026-35195-bytecode-alliance-wasmtime-out-of-bounds-write-in-string"},{"cve":"CVE-2026-35186","cvss":7.5,"epss":0.0021,"slug":"cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler","title":"Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:25.343+00:00","url":"https://junglewise.ai/threats/cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler"},{"cve":"CVE-2026-34988","cvss":6.3,"epss":0.0029,"slug":"cve-2026-34988-bytecode-alliance-wasmtime-data-leakage-in-pooling-allocator","title":"Bytecode Alliance Wasmtime data leakage in pooling allocator","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:25.16+00:00","url":"https://junglewise.ai/threats/cve-2026-34988-bytecode-alliance-wasmtime-data-leakage-in-pooling-allocator"},{"cve":"CVE-2026-34987","cvss":9.9,"epss":0.0028,"slug":"cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler","title":"Bytecode Alliance Wasmtime sandbox escape in Winch compiler backend","severity":"critical","exploited":false,"published_at":"2026-04-09T19:16:25+00:00","url":"https://junglewise.ai/threats/cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler"},{"cve":"CVE-2026-34983","cvss":5,"epss":0.0012,"slug":"cve-2026-34983-bytecode-alliance-wasmtime-use-after-free-in-linker-cloning","title":"Bytecode Alliance Wasmtime use-after-free in Linker cloning","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:24.85+00:00","url":"https://junglewise.ai/threats/cve-2026-34983-bytecode-alliance-wasmtime-use-after-free-in-linker-cloning"},{"cve":"CVE-2026-34946","cvss":7.5,"epss":0.0036,"slug":"cve-2026-34946-wasmtime-has-host-panic-when-winch-compiler-executes-table-fill","title":"Wasmtime has host panic when Winch compiler executes `table.fill`","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:24.49+00:00","url":"https://junglewise.ai/threats/cve-2026-34946-wasmtime-has-host-panic-when-winch-compiler-executes-table-fill"},{"cve":"CVE-2026-34945","cvss":6.5,"epss":0.0032,"slug":"cve-2026-34945-wasmtime-has-host-data-leakage-with-64-bit-tables-and-winch","title":"Wasmtime has host data leakage with 64-bit tables and Winch","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:24.33+00:00","url":"https://junglewise.ai/threats/cve-2026-34945-wasmtime-has-host-data-leakage-with-64-bit-tables-and-winch"},{"cve":"CVE-2026-34944","cvss":5.7,"epss":0.0023,"slug":"cve-2026-34944-wasmtime-segfault-or-unused-out-of-sandbox-load-with-f64x2-splat","title":"Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:24.187+00:00","url":"https://junglewise.ai/threats/cve-2026-34944-wasmtime-segfault-or-unused-out-of-sandbox-load-with-f64x2-splat"},{"cve":"CVE-2026-34943","cvss":7.5,"epss":0.0032,"slug":"cve-2026-34943-wasmtime-has-a-possible-panic-when-lifting-flags-component-value","title":"Wasmtime has a possible panic when lifting `flags` component value","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:24.02+00:00","url":"https://junglewise.ai/threats/cve-2026-34943-wasmtime-has-a-possible-panic-when-lifting-flags-component-value"},{"cve":"CVE-2026-34942","cvss":6.5,"epss":0.0035,"slug":"cve-2026-34942-wasmtime-panic-when-transcoding-misaligned-utf-16-strings","title":"Wasmtime: Panic when transcoding misaligned utf-16 strings","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:23.857+00:00","url":"https://junglewise.ai/threats/cve-2026-34942-wasmtime-panic-when-transcoding-misaligned-utf-16-strings"},{"cve":"CVE-2026-34941","cvss":8.1,"epss":0.0038,"slug":"cve-2026-34941-wasmtime-heap-oob-read-in-component-model-utf-16-to-latin1-utf16","title":"Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:23.693+00:00","url":"https://junglewise.ai/threats/cve-2026-34941-wasmtime-heap-oob-read-in-component-model-utf-16-to-latin1-utf16"},{"cve":"CVE-2025-62711","cvss":4,"epss":0.0043,"slug":"cve-2025-62711-wasmtime-vulnerable-to-segfault-when-using-component-resources","title":"RUSTSEC-2025-0112 - Possible host crash with host-to-wasm component intrinsics","severity":"medium","exploited":false,"published_at":"2025-10-24T22:15:49.85+00:00","url":"https://junglewise.ai/threats/cve-2025-62711-wasmtime-vulnerable-to-segfault-when-using-component-resources"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Bytecodealliance Wasmtime","slug":"bytecodealliance-wasmtime","vendor":{"hub":true,"name":"Bytecodealliance","slug":"bytecodealliance","url":"https://junglewise.ai/threats/vendors/bytecodealliance"},"aliases":[],"homepage":"https://wasmtime.dev","repo_url":"https://github.com/bytecodealliance/wasmtime","description":"Runtime for executing WebAssembly modules outside of web browsers.","url":"https://junglewise.ai/threats/technologies/bytecodealliance-wasmtime"},"most_severe":[{"cve":"CVE-2026-34987","cvss":9.9,"epss":0.0028,"slug":"cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler","title":"Bytecode Alliance Wasmtime sandbox escape in Winch compiler backend","severity":"critical","exploited":false,"published_at":"2026-04-09T19:16:25+00:00","url":"https://junglewise.ai/threats/cve-2026-34987-bytecode-alliance-wasmtime-sandbox-escape-in-winch-compiler"},{"cve":"CVE-2026-34941","cvss":8.1,"epss":0.0038,"slug":"cve-2026-34941-wasmtime-heap-oob-read-in-component-model-utf-16-to-latin1-utf16","title":"Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:23.693+00:00","url":"https://junglewise.ai/threats/cve-2026-34941-wasmtime-heap-oob-read-in-component-model-utf-16-to-latin1-utf16"},{"cve":"CVE-2026-34946","cvss":7.5,"epss":0.0036,"slug":"cve-2026-34946-wasmtime-has-host-panic-when-winch-compiler-executes-table-fill","title":"Wasmtime has host panic when Winch compiler executes `table.fill`","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:24.49+00:00","url":"https://junglewise.ai/threats/cve-2026-34946-wasmtime-has-host-panic-when-winch-compiler-executes-table-fill"},{"cve":"CVE-2026-34943","cvss":7.5,"epss":0.0032,"slug":"cve-2026-34943-wasmtime-has-a-possible-panic-when-lifting-flags-component-value","title":"Wasmtime has a possible panic when lifting `flags` component value","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:24.02+00:00","url":"https://junglewise.ai/threats/cve-2026-34943-wasmtime-has-a-possible-panic-when-lifting-flags-component-value"},{"cve":"CVE-2026-35186","cvss":7.5,"epss":0.0021,"slug":"cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler","title":"Bytecode Alliance Wasmtime out-of-bounds access in Winch compiler","severity":"high","exploited":false,"published_at":"2026-04-09T19:16:25.343+00:00","url":"https://junglewise.ai/threats/cve-2026-35186-bytecode-alliance-wasmtime-out-of-bounds-access-in-winch-compiler"},{"cve":"CVE-2026-34942","cvss":6.5,"epss":0.0035,"slug":"cve-2026-34942-wasmtime-panic-when-transcoding-misaligned-utf-16-strings","title":"Wasmtime: Panic when transcoding misaligned utf-16 strings","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:23.857+00:00","url":"https://junglewise.ai/threats/cve-2026-34942-wasmtime-panic-when-transcoding-misaligned-utf-16-strings"},{"cve":"CVE-2026-34945","cvss":6.5,"epss":0.0032,"slug":"cve-2026-34945-wasmtime-has-host-data-leakage-with-64-bit-tables-and-winch","title":"Wasmtime has host data leakage with 64-bit tables and Winch","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:24.33+00:00","url":"https://junglewise.ai/threats/cve-2026-34945-wasmtime-has-host-data-leakage-with-64-bit-tables-and-winch"},{"cve":"CVE-2026-34988","cvss":6.3,"epss":0.0029,"slug":"cve-2026-34988-bytecode-alliance-wasmtime-data-leakage-in-pooling-allocator","title":"Bytecode Alliance Wasmtime data leakage in pooling allocator","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:25.16+00:00","url":"https://junglewise.ai/threats/cve-2026-34988-bytecode-alliance-wasmtime-data-leakage-in-pooling-allocator"},{"cve":"CVE-2026-34944","cvss":5.7,"epss":0.0023,"slug":"cve-2026-34944-wasmtime-segfault-or-unused-out-of-sandbox-load-with-f64x2-splat","title":"Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:24.187+00:00","url":"https://junglewise.ai/threats/cve-2026-34944-wasmtime-segfault-or-unused-out-of-sandbox-load-with-f64x2-splat"},{"cve":"CVE-2026-35195","cvss":5.4,"epss":0.0022,"slug":"cve-2026-35195-bytecode-alliance-wasmtime-out-of-bounds-write-in-string","title":"Bytecode Alliance Wasmtime out-of-bounds write in string transcoding","severity":"medium","exploited":false,"published_at":"2026-04-09T19:16:25.5+00:00","url":"https://junglewise.ai/threats/cve-2026-35195-bytecode-alliance-wasmtime-out-of-bounds-write-in-string"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}