Security readout for executives and security teams
Plain-English summary
CVE-2026-24116 affects Wasmtime, a WebAssembly runtime. On x86-64 systems with AVX, certain Wasmtime versions may read beyond the intended memory area when compiling a specific floating-point instruction. The main business risk is service crash when protective trapping is disabled. A more sensitive out-of-sandbox read is described only under weakened guard-page settings and is not reported as guest-visible by itself.
Executive priority
Prioritize remediation for services running untrusted WebAssembly or customer-supplied plugins. For internal-only, trusted workloads, treat as a scheduled but timely platform update. The issue is moderate severity, with no cited exploitation, but can cause crashes under specific unsafe configurations.
Technical view
Wasmtime versions 29.0.0 through unpatched 36.x, 37.0.0 through unpatched 40.x, and 41.0.0 are affected. Cranelift compilation of WebAssembly f64.copysign on x86-64 with AVX can load 8 extra bytes. With signals-based-traps disabled, this can cause an uncaught segfault. With guard pages disabled, out-of-sandbox data may be loaded, but sources say it is not guest-visible absent another Cranelift bug.
Likely exposure
Exposure is limited to deployments using affected Wasmtime versions on x86-64 AVX platforms. Risk increases where untrusted WebAssembly is accepted and Wasmtime configurations disable signals-based traps or guard pages. Non-Wasmtime runtimes and patched Wasmtime releases are not indicated as affected in the provided sources.
Exploitation context
No active exploitation is cited, and the CVE is not marked KEV. The advisory frames impact mainly as availability loss through segfault under specific configuration. The out-of-sandbox load scenario requires guard pages to be disabled and is not stated to expose data to WebAssembly guests without another bug.
Researcher notes
Key variables are Wasmtime version, x86-64 AVX presence, Cranelift use, and runtime trap/guard-page configuration. Sources identify CWE-125 and CVSS 4.1. The advisory explicitly limits confidentiality impact unless another Cranelift bug makes loaded out-of-sandbox data visible to guests.
Mitigation direction
- Upgrade Wasmtime to 36.0.5, 40.0.3, or 41.0.1 as appropriate.
- Move unsupported affected versions to a supported patched major version.
- Enable signals-based-traps if immediate upgrade is not possible.
- Do not disable guard pages as a workaround; they are defense-in-depth.
- Review vendor guidance before applying configuration changes.
Validation and detection
- Inventory applications and services embedding Wasmtime.
- Confirm Wasmtime version is not in an affected range.
- Identify x86-64 AVX deployments using Wasmtime and Cranelift.
- Review Wasmtime Config settings for signals_based_traps.
- Review memory guard page configuration and avoid disabled guard pages.
- Confirm upgraded binaries or dependencies resolve to patched versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24116 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
4.1MediumVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73CVE reference · x_refsource_CONFIRM
- https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6CVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440CVE reference · x_refsource_MISC
- https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227CVE reference · x_refsource_MISC
- https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_trapsCVE reference · x_refsource_MISC
- https://docs.wasmtime.dev/stability-release.htmlCVE reference · x_refsource_MISC
- https://rustsec.org/advisories/RUSTSEC-2026-0006.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.