Improper access control in Wasmtime - CVE-2026-34988
Published: April 10, 2026
Vulnerability identifier: #VU125755
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-34988
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Bytecode Alliance
Affected software:
Wasmtime
Wasmtime
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the pooling allocator linear memory permission reset logic when reusing linear memory across instances under specific pooling allocator configurations. A remote user can trigger reuse of linear memory to disclose sensitive information.
Exploitation requires the pooling allocator to be in use, Config::memory_guard_size to be 0, Config::memory_reservation to be less than 4GiB, and max_memory_size to match memory_reservation.
How to mitigate CVE-2026-34988
Install security update from vendor's website.