---
title: "CVE-2026-34971: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift"
url: https://erroneo.us/security/cve/CVE-2026-34971/
description: "CVE-2026-34971 (wasmtime (crates.io (Rust))): Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-04-09
date_modified: 2026-07-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-34971"
kev: false
cvss: 9
epss: 0.00388
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-34971: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.4% , percentile 32: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 32% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes wasmtime (crates.io (Rust)) >= 32.0.0, < 36.0.7, fixed in 36.0.7 ; wasmtime (crates.io (Rust)) >= 37.0.0, < 42.0.2, fixed in 42.0.2 ; wasmtime (crates.io (Rust)) = 43.0.0, fixed in 43.0.1 . Check your lockfile, including transitive dependencies.

## What it is

Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address is accessed. When combined with explicit bounds checks a guest WebAssembly module this can create a situation where there are two diverging computations for the same address: one for the address to bounds-check and one for the address to load. This difference in address being operated on means that a guest module can pass a bounds check but then load a different address. Combined together this enables an arbitrary read/write primitive for guest WebAssembly when accesssing host memory. This is a sandbox escape as guests are able to read/write arbitrary host memory. This vulnerability has a few ingredients, all of which must be met, for this situation to occur and bypass the sandbox restrictions. This miscompiled shape of load only occurs on 64-bit WebAssembly linear memories, or when Config::wasmmemory64 is enabled. 32-bit WebAssembly is not affected. Spectre mitigations or signals-based-traps must be disabled. When spectre mitigations are enabled then the offending shape of load is not generated. When signals-based-traps are disabled then spectre mitigations are also automatically disabled. The specific bug in Cranelift is a miscompile of a load of the shape load(iadd(base, ishl(index, amt))) where amt is a constant. The amt value is masked incorrectly to test if it's a certain value, and this incorrect mask means that Cranelift can pattern-match this lowering rule during instruction selection erroneously, diverging from WebAssembly's and Cranelift's semantics. This incorrect lowering would, for example, load an address much further away than intended as the correct address's computation would have wrapped around to a smaller value insetad. This vulnerability is fixed in 36.0.7, 42.0.2, and 43.0.1.

## Affected packages

- crates.io (Rust) `wasmtime` >= 32.0.0, < 36.0.7 → fixed: 36.0.7
- crates.io (Rust) `wasmtime` >= 37.0.0, < 42.0.2 → fixed: 42.0.2
- crates.io (Rust) `wasmtime` = 43.0.0 → fixed: 43.0.1

## Affected products (CVE record)

- bytecodealliance wasmtime: >= 32.0.0, < 36.0.7, >= 37.0.0, < 42.0.2, >= 43.0.0, < 44.0.1

## Severity

- GitHub_M CVSS 4.0: 9 `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- CISA-ADP CVSS 3.1: 7.8 `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`
- redhat-SADP CVSS 3.1: 8.5 `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 4.0: 9.0 `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.39% probability of exploitation activity in the next 30 days; percentile 32.

## Sources

- [GitHub Advisory GHSA-jhxm-h53p-jm7w](https://github.com/advisories/GHSA-jhxm-h53p-jm7w)
- [CVE.org record CVE-2026-34971](https://www.cve.org/CVERecord?id=CVE-2026-34971)
- [NVD entry CVE-2026-34971](https://nvd.nist.gov/vuln/detail/CVE-2026-34971)
- [github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-34971)
- [RHBZ#2457008](https://bugzilla.redhat.com/show_bug.cgi?id=2457008)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34971.json)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0096.html)

---
Source page: https://erroneo.us/security/cve/CVE-2026-34971/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt