{"id":"CVE-2026-34942","aliases":["GHSA-jxhv-7h78-9775","RUSTSEC-2026-0092"],"url":"https://o3.security/vulnerability/CVE-2026-34942","summary":"Wasmtime panics when transcoding misaligned utf-16 strings","details":"### Impact\n\nWasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. \n\nHost panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.\n\n### Patches\n\nWasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.\n\n### Workarounds\n\nThere is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.","published":"2026-04-09T18:32:56.456Z","modified":"2026-08-12T03:51:26.921552355Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"24.0.7"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"36.0.7"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"42.0.2"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"43.0.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34942.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34942"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0092.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:26.921552355Z"}}