4.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24116

CVE-2026-24116: Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the f64.copysign WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24116

CVE-2026-24116:

4.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wasmtime	rust	>= 29.0.0, < 36.0.5	36.0.5
wasmtime	rust	>= 37.0.0, < 40.0.3	40.0.3
wasmtime	rust	= 41.0.0	41.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability resides in the Cranelift code generation backend of Wasmtime, specifically within the instruction lowering logic for the x86-64 architecture. The analysis of the patches reveals that the issue is not in a standard Rust function but in the instruction selection rules written in the ISLE domain-specific language, located in the cranelift/codegen/src/isa/x64/lower.isle file. The core of the problem is with the fcopysign instruction for both f32 and f64 floating-point types.

The vulnerable logic allowed the compiler to perform a load-sinking optimization, merging a memory load operation with the fcopysign operation. This optimization was flawed, as it could incorrectly widen the memory load from its intended size (e.g., 64 bits for an f64.load) to 128 bits to match the size of the XMM registers used for the bitwise operations that implement fcopysign. This oversized read could extend past the boundary of a mapped memory region, particularly when reading near a guard page.

In a non-default Wasmtime configuration where signal-based trap handlers are disabled, this out-of-bounds read results in an unhandled segmentation fault, crashing the host process and causing a denial of service. The identified vulnerable 'function' is the lower rule in the ISLE file, as this is where the flawed code generation logic exists. The patch rectifies this by forcing the operands of fcopysign into registers before the operation, thereby preventing the problematic load-sinking optimization from occurring.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.