Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-09 | 2 | Disclosure2 |
| 2026-07-02 | 1 | General1 |
@usr_bin_roygbiv @zekramu Ok i stand corrected its shitty code built on rust. CVE-2026-55407 CVE-2026-35195 CVE-2026-34942 RUSTSEC-2026-0185
Post summary
The message merely references several CVEs and comments on Rust code quality, without providing evidence of PoC, exploit tools, active exploitation, patches, or technical details.
🚨*CVE* CVE-2026-34942 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 … https://www.cve.org/CVERecord?id=CVE-2026-34942 ----- Traducción: CVE-2026-34942 Was… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-34942, noting affected Wasmtime versions and describing a UTF‑16 transcoding issue, but provides no PoC, exploit, or mitigation details.
CVE-2026-34942 Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 … https://www.cve.org/CVERecord?id=CVE-2026-34942
Post summary
A CVE has been disclosed for Wasmtime, indicating that versions up to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 contain a string transcoding defect in the Component Model’s UTF‑16 implementation. No exploit or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bytecodealliance | wasmtime | - | rust | - |