CVE-2026-34944
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
23/100
Published: 2026-04-09
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
Active
S:
X
AT:
Present
VC:
None
VI:
None
VA:
High
Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| bytecodealliance | wasmtime | < 24.0.7 |
References & Advisories (1)
Vendor Advisory