PT-2026-4857 · Bytecode Alliance · Wasmtime

Louismerlin · Published 2026-01-01 · Updated 2026-02-12 · CVE-2026-24116

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.5 Wasmtime versions 36.0.5 through 40.0.2 Wasmtime versions 40.0.3 through 41.0.0 Wasmtime versions 41.0.1

Description A flaw in Wasmtime's Cranelift compiler can lead to a host-level segmentation fault when processing malicious WebAssembly modules. Specifically, the f64.copysign WebAssembly instruction, when compiled with Cranelift on x86-64 platforms with AVX enabled, may load an excessive amount of data from memory. This can result in an uncaught segfault if signals-based traps are disabled and guard pages are enabled, potentially causing a denial-of-service condition. The issue arises from an incorrect memory load size during compilation, leading to out-of-bounds access. The vulnerability does not affect Wasmtime's default configuration, which has signals-based traps enabled.

Recommendations Upgrade to Wasmtime version 36.0.5 or later. Upgrade to Wasmtime version 40.0.3 or later. Upgrade to Wasmtime version 41.0.1 or later. As a workaround, enable signals-based traps.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-75533

AZL-75536

CVE-2026-24116

GHSA-VC8C-J3XM-XJ73

RUSTSEC-2026-0006

Affected Products

Wasmtime

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24116.json · Exploit
• https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6 · Patch
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73 · Vendor Advisory
• https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440 · Patch
• https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24116 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24116 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24116 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24116 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24116 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24116 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0006 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc8c-j3xm-xj73 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75533 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75536 · Vendor Advisory