CVE-2026-34944— Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
Quick assessment
Affected
bytecodealliance wasmtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于在禁用SSE3的x86-64平台上，Wasmtime使用Cranelift编译f64x2.splat WebAssembly指令时可能加载超出必要的8个字节，在禁用基于信号的陷阱时可能导致未捕获的段错误，在禁用保护页时可能加载沙箱外数据，但该数据对WebAssembly访客不可见。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-34944
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
Source: CVE Program / CVE List V5
Vulnerability Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
wasmtime 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wasmtime是Bytecode Alliance开源的一个轻量级WebAssembly运行时。 Wasmtime 24.0.7之前版本、36.0.7之前版本、42.0.2之前版本和43.0.1之前版本存在安全漏洞，该漏洞源于在禁用SSE3的x86-64平台上，Wasmtime使用Cranelift编译f64x2.splat WebAssembly指令时可能加载超出必要的8个字节，在禁用基于信号的陷阱时可能导致未捕获的段错误，在禁用保护页时可能加载沙箱外数据，但该数据对WebAssembly访客不可见。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bytecodealliance | wasmtime | < 24.0.7 | - |
|
II. Public POCs for CVE-2026-34944
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34944
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-34944 (1)
Same Patch Batch · bytecodealliance · 2026-04-09 · 12 CVEs total
| CVE-2026-35195 | Wasmtime has an out-of-bounds write or crash when transcoding component model strings | |
| CVE-2026-35186 | Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backe | |
| CVE-2026-34983 | Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` | |
| CVE-2026-34941 | Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding | |
| CVE-2026-34942 | Wasmtime panics when transcoding misaligned utf-16 strings | |
| CVE-2026-34988 | Wasmtime leaks data between pooling allocator instances | |
| CVE-2026-34971 | Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift | |
| CVE-2026-34946 | Wasmtime's host panics when Winch compiler executes `table.fill` | |
| CVE-2026-34945 | Wasmtime leaks host data with 64-bit tables and Winch | |
| CVE-2026-34987 | Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access | |
| CVE-2026-34943 | Wasmtime panics when lifting `flags` component value |
IV. Related Vulnerabilities
Same product: wasmtime
-
CVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms f -
CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation -
CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT -
CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o -
CVE-2026-35195
Wasmtime has an out-of-bounds write or crash when transcodin
Same vendor: bytecodealliance
-
CVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms f -
CVE-2026-54786
Wasmtime: Leak in WASIp1 `fd_renumber` implementation -
CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT -
CVE-2026-44216
Wasmtime: Panic when allocating a table exceeding the size o -
CVE-2026-35195
Wasmtime has an out-of-bounds write or crash when transcodin
Same weakness: CWE-248
-
CVE-2026-77781
Tie::Hash::Regex versions before 2.0.0 for Perl will throw a -
CVE-2026-53530
ratex-parser panics on `\verb` with a multibyte delimiter (U -
CVE-2026-52731
ZEBRA: Full node denial of service via non-ASCII LongPollId -
CVE-2026-52738
ZEBRA: Finalized address balance credit-first overflow on co -
CVE-2026-52739
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Ze
V. Comments for CVE-2026-34944
No comments yet