CVE-2026-34971: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 0.4%, percentile 32: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 32% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes wasmtime (crates.io (Rust)) >= 32.0.0, < 36.0.7, fixed in 36.0.7; wasmtime (crates.io (Rust)) >= 37.0.0, < 42.0.2, fixed in 42.0.2; wasmtime (crates.io (Rust)) = 43.0.0, fixed in 43.0.1. Check your lockfile, including transitive dependencies.

What it is

Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an arbitrary read/write primitive for guest WebAssembly when accesssing host memory. This is a sandbox escape as guests are able to read/write arbitrary host memory. This vulnerability has a few ingredients, all of which must be met, for this situation to occur and bypass the sandbox restrictions. This miscompiled shape of load only occurs on 64-bit WebAssembly linear memories, or when Config::wasmmemory64 is enabled. 32-bit WebAssembly is not affected. Spectre mitigations or signals-based-traps must be disabled. When spectre mitigations are enabled then the offending shape of load is not generated. When signals-based-traps are disabled then spectre mitigations are also automatically disabled. The specific bug in Cranelift is a miscompile of a load of the shape load(iadd(base, ishl(index, amt))) where amt is a constant. The amt value is masked incorrectly to test if it's a certain value, and this incorrect mask means that Cranelift can pattern-match this lowering rule during instruction selection erroneously, diverging from WebAssembly's and Cranelift's semantics. This incorrect lowering would, for example, load an address much further away than intended as the correct address's computation would have wrapped around to a smaller value insetad. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

From the GitHub advisory

Impact

Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an arbitrary read/write primitive for guest WebAssembly when accesssing host memory. This is a sandbox escape as guests are able to read/write arbitrary host memory.

This vulnerability has a few ingredients, all of which must be met, for this situation to occur and bypass the sandbox restrictions:

This miscompiled shape of load only occurs on 64-bit WebAssembly linear memories, or when Config::wasmmemory64 is enabled. 32-bit WebAssembly is not affected. Spectre mitigations or signals-based-traps must be disabled. When spectre mitigations are enabled then the offending shape of load is not generated. When signals-based-traps are disabled then spectre mitigations are also automatically disabled.

The specific bug in Cranelift is a miscompile of a load of the shape load(iadd(base, ishl(index, amt))) where amt is a constant. The amt value is masked incorrectly to test if it's a certain value, and this incorrect mask means that Cranelift can pattern-match this lowering rule during instruction selection erroneously, diverging from WebAssembly's and Cranelift's semantics. This incorrect lowering would, for example, load an address much further away than intended as the correct address's computation would have wrapped around to a smaller value insetad.

Weakness type: CWE-125, CWE-787.

Product: wasmtime (crates.io (Rust)) · Assigned by: GitHub_M · Published: 2026-04-09

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: present (depends on deployment conditions)
• Privileges required: low (any account)
• User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.39% probability of exploitation activity in the next 30 days; percentile 32.

Timeline

• 2026-04-09 — CVE record published by GitHub_M
• 2026-04-09 — GitHub-reviewed advisory GHSA-jhxm-h53p-jm7w published (critical)
• 2026-07-15 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-jhxm-h53p-jm7w github.com
2. CVE.org record CVE-2026-34971 cve.org
3. NVD entry CVE-2026-34971 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. access.redhat.com access.redhat.com
3. RHBZ#2457008 bugzilla.redhat.com
4. security.access.redhat.com security.access.redhat.com
5. rustsec.org rustsec.org

Critical crates.io (Rust) advisories · Today’s Security Digest