CVE-2026-34944
Medium · 5.7CVSS
5.7
EPSS
0.3%
Published
Apr 9, 2026
CISA due date
—
The record
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | wasmtime | 0 | 24.0.7 |
| crates.io | wasmtime | 0.0.0-0 | 24.0.7 |
| crates.io | wasmtime | 25.0.0 | 36.0.7 |
| crates.io | wasmtime | 37.0.0 | 42.0.2 |
| crates.io | wasmtime | 43.0.0 | 43.0.1 |
Related vulnerabilities
- RUSTSEC-2026-0087 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift… Same vulnerability
- CVE-2026-44216 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- RUSTSEC-2026-0114 Panic when allocating a table exceeding the size of the host's address space Also affects wasmtime
- CVE-2026-34988 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35195 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34987 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-35186 Wasmtime is a runtime for WebAssembly. Also affects wasmtime
- CVE-2026-34971 Wasmtime is a runtime for WebAssembly. Also affects wasmtime