What’s Vulnerable › Vulnerabilities

CVE-2026-44216: Wasmtime: Panic when allocating a table exceeding the size of the host's address space

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-14 · updated 2026-10-26
• Weakness: CWE-770

Description

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.

Affected products

• bytecodealliance wasmtime: from 30.0.0 before 36.0.8; from 37.0.0 before 43.0.2; 44.0.0 — fixed in 36.0.8, 43.0.2

How to fix

Upgrade to a fixed version: bytecodealliance wasmtime 36.0.8, 43.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p8xm-42r7-89xg
• https://access.redhat.com/errata/RHSA-2026:45341
• https://access.redhat.com/security/cve/CVE-2026-44216
• https://bugzilla.redhat.com/show_bug.cgi?id=2477467
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44216.json

Get alerted when CVE-2026-44216 or the next vulnerability affects your stack