ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-34971

Wasmtime is a runtime for WebAssembly.

Published Apr 9, 2026 · catalog updated Jul 15, 2026 · Wasmtime is a runtime

Check if you run it

No confirmed exploitation is on record for CVE-2026-34971. EPSS is 0.39%. Act only if a listed version of Wasmtime is a runtime is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Wasmtime is a runtime).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.39%
Remediation
Advisory link
Affected products
cpe bytecodealliance/wasmtime

Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an arbitrary read/write primitive for guest WebAssembly when accesssing host memory. This is a sandbox escape as guests are able to read/write arbitrary host memory. This vulnerability has a few ingredients, all of which must be met, for this situation to occur and bypass the sandbox restrictions. This miscompiled shape of load only occurs on 64-bit WebAssembly linear memories, or when Config::wasm_memory64 is enabled. 32-bit WebAssembly is not affected. Spectre mitigations or signals-based-traps must be disabled. When spectre mitigations are enabled then the offending shape of load is not generated. When signals-based-traps are disabled then spectre mitigations are also automatically disabled. The specific bug in Cranelift is a miscompile of a load of the shape load(iadd(base, ishl(index, amt))) where amt is a constant. The amt value is masked incorrectly to test if it's a certain value, and this incorrect mask means that Cranelift can pattern-match this lowering rule during instruction selection erroneously, diverging from WebAssembly's and Cranelift's semantics. This incorrect lowering would, for example, load an address much further away than intended as the correct address's computation would have wrapped around to a smaller value insetad. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe bytecodealliance/wasmtime43.0.0

How to fix CVE-2026-34971

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-34971. EPSS is 0.39%. Act only if a listed version of Wasmtime is a runtime is installed.

Which versions are affected?

Compare what you have installed with 43.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-125: Out-of-bounds Read; CWE-787: Out-of-bounds Write. EPSS 0.39%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 9, 2026 · NIST NVD

    Detected

    Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the

  2. Jul 15, 2026 · NIST NVD

    Updated

    Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the

Sources

  • CVE.orgVulnerability recordCVE-2026-34971

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-34971

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-34971

    Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.