CVE-2026-34987

medium Red Hat
CVSS v3 Base Score
8.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Published: April 9, 2026 (34 days ago)
Last Modified: April 9, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in Wasmtime, a runtime for WebAssembly. When using its non-default Winch compiler backend, a properly constructed guest WebAssembly (Wasm) module can exploit an incorrect assumption in how memory offsets are handled. This allows the guest Wasm to access host memory outside its designated sandbox. Such access could lead to a denial of service, arbitrary data leakage from the host process, or potentially arbitrary code execution.

CWE

CWE-681

Affected Products

Red Hat Connectivity Link 1Red Hat Enterprise Linux 10

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com