Arbitrary Memory Access Vulnerability in Wasmtime WebAssembly Runtime
CVE-2026-34971

9CRITICAL

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
9 April 2026

What is CVE-2026-34971?

Wasmtime, a runtime for WebAssembly, contains a vulnerability stemming from a bug in the Cranelift compilation backend that allows for arbitrary read/write access to host memory. This issue arises when performing specific heap accesses on aarch64 architecture, where incorrect bounds checks can enable a malicious guest WebAssembly module to bypass sandbox restrictions. The miscompiled load operation can lead to unauthorized memory access, which poses significant security risks. Mitigations related to Spectre must be properly configured to avoid this vulnerability. It is crucial for users to upgrade to version 36.0.7, 42.0.2, or 43.0.1 to protect against this threat.

Affected Version(s)

wasmtime >= 32.0.0, < 36.0.7 < 32.0.0, 36.0.7

wasmtime >= 37.0.0, < 42.0.2 < 37.0.0, 42.0.2

wasmtime >= 43.0.0, < 44.0.1 < 43.0.0, 44.0.1

References

https://github.com/bytecodealliance/wasmtime/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.