bytecodealliance wasmtime up to 36.0.4/40.0.2/41.0.0 on x86-64 out-of-bounds

Summaryinfo

A vulnerability has been found in bytecodealliance wasmtime up to 36.0.4/40.0.2/41.0.0 on x86-64 and classified as problematic. This affects an unknown function. This manipulation causes out-of-bounds. This vulnerability is tracked as CVE-2026-24116. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in bytecodealliance wasmtime up to 36.0.4/40.0.2/41.0.0 on x86-64. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. The summary by CVE is:

Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-24116 since 01/21/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 296927 (Linux Distros Unpatched Vulnerability : CVE-2026-24116), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 36.0.5 or 40.0.3 eliminates this vulnerability. Applying the patch 728fa07184f8da2a046f48ef9b61f869dce133a6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (296927). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• bytecodealliance

Name

• wasmtime

Version

• 36.0.0
• 36.0.1
• 36.0.2
• 36.0.3
• 36.0.4
• 40.0.0
• 40.0.1
• 40.0.2
• 41.0

License

• open-source

Website

• Product: https://github.com/bytecodealliance/wasmtime/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion