1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34983

CVE-2026-34983: Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`

Wasmtime is a runtime for WebAssembly. In 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. This bug is not controllable by guest Wasm programs. It can only be triggered by a specific sequence of embedder API calls made by the host. Specifically, the following steps must occur to trigger the bug clone a wasmtime::Linker, drop the original linker instance, use the new, cloned linker instance, resulting in a use-after-free. This vulnerability is fixed in 43.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34983

CVE-2026-34983:

1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wasmtime	rust	= 43.0.0	43.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a use-after-free in the wasmtime crate, version 43.0.0. The root cause lies in the try_clone implementation for the internal StringPool structure, located in crates/environ/src/string_pool.rs. The vulnerable try_clone function performed a shallow copy of a map containing string keys that were pointers into the original object's string storage.

When a user clones a wasmtime::Linker instance, this vulnerable try_clone method is called internally. If the original Linker instance is then dropped, the memory holding the strings is freed, but the cloned Linker still holds pointers to this freed memory. Any subsequent operation on the cloned Linker that accesses these strings, such as module instantiation, will result in a use-after-free, typically causing a segmentation fault.

The patch, found in commit 82581af77d1c465ce49fb8e6ca042bc274bf3ca2, corrects this by changing the StringPool::try_clone implementation to create a new string allocation for the clone and re-intern all the strings, ensuring the clone has its own valid string storage.

Therefore, the primary vulnerable function is wasmtime::environ::string_pool::StringPool::try_clone, and the user-triggered vulnerable function that would appear in a runtime profile is wasmtime::linker::Linker<T>::clone.

Vulnerable functions

wasmtime::environ::string_pool::StringPool::try_clone

crates/environ/src/string_pool.rs

The `try_clone` function for `StringPool` performed a shallow copy of its internal map. This map contained string slices (`&'static str`) that pointed to the memory of the original `StringPool`'s string storage. When the original `StringPool` (and the `Linker` that owned it) was dropped, these pointers became invalid, leading to a use-after-free if the cloned `StringPool` was used.

wasmtime::linker::Linker<T>::clone

crates/wasmtime/src/linker.rs

This is the main public-facing function that triggers the use-after-free vulnerability. Calling `clone` on a `wasmtime::Linker` instance would invoke the unsound `try_clone` implementation on the internal `StringPool`, creating a cloned `Linker` with dangling pointers in its string pool. Subsequent use of this cloned linker after the original is dropped results in a use-after-free.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.