Is there a patch available for CVE-2026-34944?

Yes, a patch is available for CVE-2026-34944. Update the affected software to the latest version immediately.

Wasmtime CVE-2026-34944

Q: What is the CVSS score of CVE-2026-34944?

CVE-2026-34944 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21023 MEDIUM

Uncaught Exception (CWE-248)

2026-04-09 GitHub_M

GHSA-qqfj-4vcm-26hv

Information Disclosure Wasmtime

4.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

3.1 LOW

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Red Hat

4.7 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 19:15 euvd

EUVD-2026-21023

Analysis Generated

Apr 09, 2026 - 19:15 vuln.today

CVE Published

Apr 09, 2026 - 18:38 nvd

MEDIUM 4.1

DescriptionGitHub Advisory

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

AnalysisAI

Wasmtime's Cranelift compiler generates inefficient code for the f64x2.splat WebAssembly instruction on x86-64 platforms with SSE3 disabled, causing it to load 8 excess bytes beyond the intended operand. On systems with signals-based traps disabled, this overflow access can trigger segmentation faults from unmapped guard pages; with guard pages also disabled, out-of-sandbox memory is accessible to the runtime (though not to WebAssembly guests themselves). The vulnerability affects Wasmtime versions prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, and is fixed in those releases. No public exploit code or active exploitation (KEV) is documented.

Technical ContextAI

Wasmtime is a WebAssembly runtime maintained by the Bytecode Alliance that uses the Cranelift code generator for JIT compilation. The vulnerability stems from a code generation defect (CWE-248: Uncaught Exception) in how Cranelift handles the f64x2.splat SIMD instruction when SSE3 CPU extensions are unavailable. On x86-64, Cranelift falls back to scalar operations for f64x2.splat but miscalculates the memory footprint, issuing a load instruction that reads 16 bytes instead of the required 8 bytes. This overflow traverses into adjacent memory that may be unmapped (guard pages for stack/heap isolation) or contain data outside the WebAssembly sandbox. The issue is specific to x86-64 architectures and only manifests when SSE3 is disabled at compile time or runtime.

RemediationAI

Upgrade Wasmtime to version 24.0.7, 36.0.7, 42.0.2, or 43.0.1 or later, depending on your current release branch. Users should coordinate with their release management process to adopt the nearest patched version in their supported track. As an interim mitigation for deployments unable to patch immediately, ensure SSE3 is enabled on x86-64 hardware or emulation layer (most modern CPUs and virtual machines support this natively); verify that signals-based traps and guard pages remain enabled in the Wasmtime configuration (these are typically the default and provide additional defense-in-depth). For detailed guidance and upgrade procedures, consult the Bytecode Alliance advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv.