CVE-2026-34983 — Use After Free in Wasmtime

CWE-416 — Use After FreeCWE-825 — Expired Pointer Dereference39 documents7 sources
Severity
1.0LOWNVD
EPSS
0.0%
top 98.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Bytecodealliance Wasmtime
Timeline
PublishedApr 9

Description

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.

CVSS vector

CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶crates.iobytecodealliance/wasmtime43.0.0 — 43.0.1
▶CVEListV5bytecodealliance/wasmtime>= 43.0.0, < 43.0.1

🔴Vulnerability Details

4
OSV
Use-after-free bug after cloning `wasmtime::Linker`↗2026-04-09
▶
OSV
Wasmtime has use-after-free bug after cloning `wasmtime::Linker`↗2026-04-09
▶
VulDB
bytecodealliance wasmtime up to 43.0.0 API Call wasmtime::Linker use after free (GHSA-hfr4-7c6c-48w2)↗2026-04-09
▶
GHSA
Wasmtime has use-after-free bug after cloning `wasmtime::Linker`↗2026-04-09
▶

📋Vendor Advisories

1
Red Hat
wasmtime: Wasmtime: Use-after-free due to unsound linker cloning↗2026-04-09
▶

🕵️Threat Intelligence

31
Wiz
CVE-2026-34944 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
RUSTSEC-2026-0093 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
RUSTSEC-2026-0095 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-35406 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
RUSTSEC-2026-0085 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2026-34983 tree-sitter: Wasmtime: Use-after-free due to unsound linker cloning [fedora-all]↗2026-04-09
▶
Bugzilla
CVE-2026-34983 wasmtime: Wasmtime: Use-after-free due to unsound linker cloning↗2026-04-09
▶