CVE-2026-35195

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory. These writes on the host could hit unmapped memory or could corrupt host data structures depending on Wasmtime's configuration. Wasmtime by default reserves 4GiB of virtual memory for a guest's linear memory meaning that this bug will by default on hosts cause the host to hit unmapped memory and abort the process due to an unhandled fault. Wasmtime can be configured, however, to reserve less memory for a guest and to remove all guard pages, so some configurations of Wasmtime may lead to corruption of data outside of a guest's linear memory, such as host data structures or other guests's linear memories. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

• CWE-787

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgmVendor Advisory

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35187pyLoad is a free and open-source download manager written in…7.7
• CVE-2026-35188Issue summary: A malicious server can exploit TLS OCSP stapl…5
• CVE-2026-3519OS Command Injection Remote Code Execution Vulnerability in …7.2
• CVE-2026-35192An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5…6.5
• CVE-2026-35193An issue was discovered in Django 5.2 before 5.2.15 and 6.0 …3.1
• CVE-2026-35194Code injection in SQL code generation in Apache Flink 1.15.0…8.1
• CVE-2026-35196Chamilo LMS is an open-source learning management system. In…8.8
• CVE-2026-35197dye is a portable and respectful color library for shell scr…9.8
• CVE-2026-35198HeyForm is an open-source form builder. Prior to version 3.0…9
• CVE-2026-35199SymCrypt is the core cryptographic function library currentl…6.1
• CVE-2026-3520Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-35200Parse Server is an open source backend that can be deployed …5.4