CVE-2026-34983
Medium · 5.0CVSS
5.0
EPSS
0.1%
Published
Apr 9, 2026
CISA due date
—
The record
Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmtime | 43.0.0 | 43.0.1 |
Related vulnerabilities
- RUSTSEC-2026-0090 Use-after-free bug after cloning `wasmtime::Linker` Same vulnerability
- CVE-2026-44216 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- RUSTSEC-2026-0114 Panic when allocating a table exceeding the size of the host's address space Also affects wasmtime
- CVE-2026-34988 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35195 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34987 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35186 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34971 Wasmtime is a runtime for WebAssembly. Also affects wasmtime