CVE-2026-34971
Arbitrary Read/Write in Wasmtime Cranelift on aarch
Publication date: 2026-04-09
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bytecodealliance | wasmtime | From 37.0.0 (inc) to 42.0.2 (exc) |
| bytecodealliance | wasmtime | From 32.0.0 (inc) to 36.0.7 (exc) |
| bytecodealliance | wasmtime | 43.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34971 is a critical vulnerability in Wasmtime's Cranelift compilation backend on the aarch64 architecture. It arises from a miscompilation of a specific heap access pattern in guest WebAssembly modules, where the computed load address diverges from the address used in explicit bounds checks.
This discrepancy allows a guest module to pass a bounds check but then load or write to a different, potentially out-of-bounds address in host memory. This effectively enables arbitrary read and write access to host memory, resulting in a sandbox escape.
The bug only affects 64-bit WebAssembly linear memories or when the wasm_memory64 configuration is enabled, and requires that Spectre mitigations or signals-based traps be disabled. The vulnerability is caused by incorrect masking of a constant value during instruction selection in Cranelift, leading to erroneous lowering of a load instruction.
This vulnerability is fixed in Wasmtime versions 36.0.7, 42.0.2, and 43.0.1.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows a guest WebAssembly module to escape its sandbox and gain arbitrary read and write access to the host's memory.
Such arbitrary memory access can lead to unauthorized disclosure of sensitive data, corruption of host memory, execution of arbitrary code, and potential system compromise.
Because the attack can be performed remotely with low privileges and no user interaction, it poses a critical security risk to systems running vulnerable versions of Wasmtime on aarch64.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is specific to Wasmtime's Cranelift compilation backend on the aarch64 architecture and involves a miscompilation of a specific load instruction pattern in guest WebAssembly modules. Detection involves identifying if your system is running affected Wasmtime versions (>= 32.0.0 to <= 36.0.6, >= 37.0.0 to <= 42.0.1, and 43.0.0) on aarch64 with 64-bit WebAssembly linear memories or Config::wasm_memory64 enabled.
Since the vulnerability depends on specific Wasmtime versions and configuration, detection can start by checking the Wasmtime version installed on your system.
- Check Wasmtime version: `wasmtime --version`
- Verify if your WebAssembly workloads use 64-bit linear memories or enable wasm_memory64 configuration.
- Check if Spectre mitigations or signals-based traps are disabled, as the vulnerability requires these to be disabled for exploitation.
There are no specific network detection commands or signatures provided for this vulnerability because it is a runtime compilation bug exploitable by crafted WebAssembly modules. Monitoring for unusual Wasmtime behavior or sandbox escapes may help, but no direct commands for detection are documented.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade Wasmtime to a patched version that fixes this vulnerability.
- Upgrade Wasmtime to version 36.0.7, 42.0.2, or 43.0.1 or later.
Additionally, ensure that Spectre mitigations and signals-based traps are enabled, as the vulnerability requires these to be disabled for exploitation.
- Enable Spectre mitigations and signals-based traps in your Wasmtime configuration.
Avoid running untrusted or potentially malicious WebAssembly modules on affected Wasmtime versions until patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Wasmtime's Cranelift compilation backend allows a guest WebAssembly module to bypass sandbox restrictions and gain arbitrary read/write access to host memory. This sandbox escape could potentially lead to unauthorized access to sensitive data or system resources.
Such unauthorized access risks violating data protection and privacy requirements outlined in common standards and regulations like GDPR and HIPAA, which mandate strict controls over access to personal and sensitive information.
Therefore, if exploited, this vulnerability could compromise compliance with these regulations by enabling attackers to access or manipulate protected data without authorization.