Answer in brief
CVE-2026-44216 records a High severity (CVSS 7.5) vulnerability in Wasmtime: Panic when allocating a table exceeding the size of the host's address space. The current sources do not mark it as known exploited. The current feed maps bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| bytecodealliance/wasmtimegeneric | >= 30.0.0, < 36.0.8 || >= 37.0.0, < 43.0.2 || 44.0.0 | Not reported |
Published upstream
May 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 13, 2026
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-44216 records a High severity (CVSS 7.5) vulnerability in Wasmtime: Panic when allocating a table exceeding the size of the host's address space. The current sources do not mark it as known exploited. The current feed maps bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps bytecodealliance/wasmtime (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| bytecodealliance/wasmtimegeneric | >= 30.0.0, < 36.0.8 || >= 37.0.0, < 43.0.2 || 44.0.0 | Not reported |
Published upstream
May 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 13, 2026
Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.
Quoted source text, attributed separately from HOL analysis.