CVE-2026-34942 — Wasmtime panics when transcoding misaligned utf-16 strings

Affected: bytecodealliance wasmtime

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses. Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

GHSA-jxhv-7h78-9775 — Wasmtime: Panic when transcoding misaligned utf-16 strings

Affected: crates.io: wasmtime

### Impact

Wasmtime's implementation of transcoding strings into the Component Model's `utf16` or `latin1+utf16` encodings improperly verified the alignment of reallocated strings. This meant that unaligned pointers could be passed to the host for transcoding which would trigger a host panic. This panic is possible to trigger from malicious guests which transfer very specific strings across components with specific addresses.

Host panics are considered a DoS vector in Wasmtime as the panic conditions are controlled by the guest in this situation.

### Patches

Wasmtime 24.0.7, 36.0.7, 42.0.2, and 43.0.1 have been issued to fix this bug. Users are recommended to update to these patched versions of Wasmtime.

### Workarounds

There is no workaround for this bug. Hosts are recommended to updated to a patched version of Wasmtime.

Most recent entries from all

CVE-2026-34942 — Wasmtime panics when transcoding misaligned utf-16 strings

GHSA-jxhv-7h78-9775 — Wasmtime: Panic when transcoding misaligned utf-16 strings