{"id":"CVE-2026-34944","aliases":["GHSA-qqfj-4vcm-26hv","RUSTSEC-2026-0087"],"url":"https://o3.security/vulnerability/CVE-2026-34944","summary":"Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64","details":"Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.","published":"2026-04-09T18:38:16.182Z","modified":"2026-08-07T11:31:08.239892740Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"24.0.7"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"36.0.7"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"42.0.2"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"43.0.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34944.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34944"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:31:08.239892740Z"}}