CVE-2026-34944: Wasmtime Buffer Overflow Vulnerability

CVE-2026-34944 Overview

CVE-2026-34944 is an Out-of-Bounds Read vulnerability affecting Wasmtime, a runtime for WebAssembly. On x86-64 platforms with SSE3 disabled, Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than necessary. This improper memory access can lead to denial of service conditions through uncaught segfaults or potential information exposure from out-of-sandbox memory regions.

Critical Impact

When signals-based-traps are disabled, exploitation results in uncaught segfaults due to loading from unmapped guard pages. With guard pages disabled, out-of-sandbox data may be loaded, though this data is not visible to WebAssembly guests.

Affected Products

• Wasmtime versions prior to 24.0.7
• Wasmtime versions prior to 36.0.7
• Wasmtime versions prior to 42.0.2 and 43.0.1

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-34944 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-34944

Vulnerability Analysis

This vulnerability stems from improper memory handling in the Cranelift code generator when compiling the f64x2.splat WebAssembly instruction. The f64x2.splat instruction is designed to create a 128-bit SIMD vector by replicating a single 64-bit floating-point value into both lanes. However, on x86-64 platforms where SSE3 is disabled, the compilation logic incorrectly generates code that reads 8 bytes beyond the intended memory boundary.

The vulnerability is classified under CWE-248 (Uncaught Exception), as the primary exploitation scenario involves triggering uncaught segmentation faults. The impact varies based on runtime configuration: environments with signals-based traps enabled will handle the exception, while those without will experience crashes. The additional concern arises when guard pages are disabled, as the excess memory read could potentially access data outside the WebAssembly sandbox boundary.

Root Cause

The root cause lies in the Cranelift compiler's instruction selection logic for the f64x2.splat operation when SSE3 instructions are unavailable. Without SSE3, the compiler falls back to an alternative code generation path that incorrectly calculates the memory access bounds, resulting in a read operation that extends 8 bytes beyond the intended memory location. This boundary miscalculation bypasses normal memory safety guarantees that WebAssembly runtimes are expected to enforce.

Attack Vector

The attack vector is local, requiring the attacker to submit malicious WebAssembly code to a Wasmtime runtime running on an x86-64 platform with SSE3 disabled. Exploitation requires specific runtime configurations to achieve different impacts:

Denial of Service (Primary Impact):
A crafted WebAssembly module containing f64x2.splat instructions can trigger segmentation faults when signals-based traps are disabled, causing the host process to crash.

Information Exposure (Secondary Impact):
When both signals-based traps and guard pages are disabled, the out-of-bounds read may access memory outside the WebAssembly sandbox. However, this data cannot be directly observed by the WebAssembly guest code, limiting the practical exploitation of information disclosure.

The vulnerability requires local access to execute WebAssembly code, privileges to submit modules to the runtime, and specific platform and configuration conditions to be exploitable.

Detection Methods for CVE-2026-34944

Indicators of Compromise

• Unexpected segmentation faults or crashes in processes running Wasmtime on x86-64 platforms
• Application logs showing uncaught exceptions during WebAssembly module execution
• Crash dumps indicating memory access violations in Cranelift-generated code paths

Detection Strategies

• Monitor for abnormal process terminations in services utilizing Wasmtime runtime
• Implement crash reporting and analysis to identify patterns consistent with out-of-bounds memory access
• Audit WebAssembly modules submitted to your runtime for suspicious f64x2.splat instruction usage

Monitoring Recommendations

• Enable comprehensive logging for Wasmtime runtime operations including compilation events
• Configure process monitoring to alert on unexpected terminations of WebAssembly host processes
• Review system logs for segfault signals (SIGSEGV) originating from Wasmtime processes

How to Mitigate CVE-2026-34944

Immediate Actions Required

• Upgrade Wasmtime to patched versions: 24.0.7, 36.0.7, 42.0.2, or 43.0.1 depending on your current major version
• Enable signals-based traps if temporarily unable to patch, as this configuration prevents the segfault condition
• Ensure guard pages are enabled to prevent potential out-of-sandbox memory access
• Review runtime configurations on x86-64 deployments to assess exposure

Patch Information

The vulnerability is fixed in Wasmtime versions 24.0.7, 36.0.7, 42.0.2, and 43.0.1. Users should upgrade to the appropriate patched version based on their current deployment. For detailed patch information and security guidance, refer to the GitHub Security Advisory.

Workarounds

• Enable SSE3 instructions on the host platform if hardware supports it, as the vulnerability only manifests when SSE3 is disabled
• Enable signals-based traps in Wasmtime configuration to catch and handle the segfault gracefully
• Ensure guard pages remain enabled to prevent information exposure from out-of-bounds reads
• Restrict WebAssembly module execution to trusted sources until patches can be applied

# Configuration example
# Verify Wasmtime version and upgrade if necessary
wasmtime --version

# Install patched version via cargo
cargo install wasmtime-cli --version "43.0.1"

# Ensure runtime is configured with signals-based traps (default enabled)
# Review your Wasmtime configuration to confirm protective features are active