Wasmtime has improperly masked return value from table.grow with Winch compiler backend

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

6.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N · score source

EPSS

• CVE-2026-35186: 0.21% estimated exploitation activity in the next 30 days; percentile 11.71 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables this means that the result of the operator, internally in Winch, is tagged as a 64-bit value instead of a 32-bit value. This invalid internal representation of Winch's compiler state compounds into further issues depending on how the value is consumed. One example can be seen when the result of table.grow is used as the address of a load operation. The load operation is tricked into thinking the address is a 64-bit value, not a 32-bit value, which means that the final address to load from is calculated incorrectly. This can lead to a situation where the bytes before the start of linear memory can be loaded/stored to. The primary consequence of this bug is that bytes in the host's address space can be stored/read from. This is only applicable to the 16 bytes before linear memory, however, as the only significant return value of…

Published by the source

10 Apr 2026, 15:32 UTC

Last modified by the source

10 Apr 2026, 15:32 UTC

Source last checked

26 Oct 2026, 15:42 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-f984-pcp8-v2p7

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-35186

Advisory: Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend
IDs: CVE-2026-35186, GHSA-f984-pcp8-v2p7
Record: https://patchnext.com/advisories/cve-2026-35186 (revision 1, source checked 26 Oct 2026, 15:42 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: wasmtime 43.0.1, 42.0.2, 36.0.7. A vendor fix does not mean a deployment is fixed.

## Affected components
- crates.io wasmtime: affected >= 25.0.0, < 36.0.7; >= 37.0.0, < 42.0.2; >= 43.0.0, <= 43.0.0; fixed in 36.0.7, 43.0.1, 42.0.2

## Suggested inspection (read-only)
- crates.io wasmtime: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on wasmtime.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-f984-pcp8-v2p7 (GitHub-reviewed advisory GHSA-f984-pcp8-v2p7 lists affected ranges: crates.io wasmtime >=25.0.0 =37.0.0 =43.0.0 <=43.0.0)

Commands are suggestions: review each one before running it.