Log in Start free

Vulnerability · Published May 14, 2026 · Assigned by GitHub_M

CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address space

High 7.5

In plain English

A high-severity resource allocation without limits in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-wasmtimeno fix listedDEBIAN-CVE-2026-44216
Debian:14rust-wasmtime36.0.8+dfsg-1DEBIAN-CVE-2026-44216
Ubuntu:24.04:LTSrust-wasmtimeno fix listedUBUNTU-CVE-2026-44216
Ubuntu:25.10rust-wasmtimeno fix listedUBUNTU-CVE-2026-44216
Ubuntu:26.04:LTSrust-wasmtimeno fix listedUBUNTU-CVE-2026-44216
Ubuntu:26.10rust-wasmtimeno fix listedUBUNTU-CVE-2026-44216

Affected products (as reported)

VendorProductVersions
bytecodealliance wasmtime >= 30.0.0, < 36.0.8>= 37.0.0, < 43.0.244.0.0

Weakness: CWE-770, CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References