Loading story…
Two vulnerabilities in Wasmtime's WebAssembly Component Model allow a malicious guest module to disrupt host processes by abusing string transcoding and custom realloc behavior. CVE-2026-35195 is an out-of-bounds write in the Fast Assembly Component Trampolines (FACT) compiler path: during string transcoding, Wasmtime fails to validate the memory offset returned by a guest component's exported realloc function, letting an attacker supply an arbitrary 32-bit offset and potentially trigger writes up to 4 GiB outside the intended guest linear memory region. In typical default deployments, the result is a host crash due to faults on unmapped memory protected by reserved address space and guard pages.
A second flaw, CVE-2026-34942, causes a deterministic denial of service when a malicious Component Model module returns a deliberately misaligned pointer from a custom realloc function during string transfer operations. When Wasmtime writes transcoded data to that invalid alignment, Rust panics and the process terminates. While CVE-2026-34942 is limited to process crashes, CVE-2026-35195 carries higher risk in environments with reduced memory reservations or disabled guard pages, where the out-of-bounds write may lead to host memory corruption rather than only denial of service.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A second Wasmtime vulnerability, CVE-2026-35195, was disclosed affecting the FACT compiler subsystem during Component Model string transcoding. By returning an arbitrary 32-bit offset from an exported realloc function, a malicious guest can cause writes far outside intended linear memory bounds, leading to denial of service and potentially host memory corruption in less protected deployments.
A vulnerability tracked as CVE-2026-34942 was disclosed in Wasmtime's Component Model string transcoding path. A malicious WebAssembly component can return a deliberately misaligned pointer from a custom realloc function, triggering a Rust panic and crashing the host process.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly recorded CVEs describe **stack-based buffer overflow** flaws that can lead to arbitrary code execution in legacy software components. **CVE-2017-20228** affects **Flat Assembler 1.71.21**, where oversized assembly input exceeding **5895 bytes** can overwrite the instruction pointer and enable **return-oriented programming (ROP)** for shell command execution. The issue is classified as **`CWE-787`** and carries high impact to confidentiality, integrity, and availability. A second entry, **CVE-2018-25222**, affects **SC v7.16** and similarly allows code execution through oversized input, in this case beyond **1052 bytes**, resulting in instruction pointer overwrite and shellcode execution in the application context. The vulnerability is also classified as **`CWE-787`**, with CVSS scoring indicating low attack complexity and severe impact, and both CVEs include references to **Exploit-DB** and **VulnCheck advisories**, signaling the availability of public technical details for defenders to review.
Jun 29, 2026
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026
Researchers at **CISPA Helmholtz Center for Information Security** disclosed **StackWarp** (**CVE-2025-29943**), a microarchitectural weakness affecting **AMD Zen** CPUs that can undermine the integrity guarantees of **AMD SEV-SNP** “confidential VM” protections. The attack model assumes a **malicious insider with host/hypervisor control** who can run a parallel hyperthread and exploit a previously undocumented hypervisor-side control bit to manipulate the protected guest’s stack pointer behavior, particularly when **Simultaneous Multithreading (SMT)** is enabled. Reported impacts include the ability to recover sensitive data from SEV-SNP guests—such as **cryptographic private keys**—and to enable follow-on compromise scenarios like **bypassing OpenSSH password authentication** and **privilege escalation** within the VM. AMD issued patches (made available in **July 2025**) and later published a security bulletin rating the issue **low severity**, but the disclosure highlights ongoing risk that confidential computing isolation can be weakened by CPU-level behaviors; organizations running SEV-SNP should prioritize applying AMD’s updates and review SMT-related exposure in multi-tenant or high-trust boundary environments.
Jun 29, 2026