#VU125755 Improper access control in Wasmtime - CVE-2026-34988
Published: April 10, 2026
Vulnerability identifier: #VU125755
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-34988
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Wasmtime
Wasmtime
Software vendor:
Bytecode Alliance
Bytecode Alliance
Description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the pooling allocator linear memory permission reset logic when reusing linear memory across instances under specific pooling allocator configurations. A remote user can trigger reuse of linear memory to disclose sensitive information.
Exploitation requires the pooling allocator to be in use, Config::memory_guard_size to be 0, Config::memory_reservation to be less than 4GiB, and max_memory_size to match memory_reservation.
Remediation
Install security update from vendor's website.