CVE-2026-34971

OVERVIEW CVE-2026-34971 is a critical sandbox escape vulnerability in Wasmtime, an open-source WebAssembly runtime, affecting versions 32.0.0 through 36.0.6, 42.0.0-42.0.1, and 43.0.0. The flaw resides in Wasmtime's Cranelift compilation backend on aarch64 processors, where a miscompilation of specific heap access patterns causes incorrect address calculations. This allows guest WebAssembly modules to diverge between the address used for bounds checking and the address actually accessed, effectively bypassing memory sandbox protections and enabling arbitrary read/write access to host memory. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.8 (High) with a local attack vector requiring low privileges but high attack complexity. The impact is severe, with confirmed high ratings across confidentiality, integrity, and availability. Exploitation requires multiple specific conditions to be met simultaneously, including 64-bit WebAssembly linear memories and disabled Spectre mitigations or signal-based traps, which increases the practical attack complexity. The potential impact represents a complete sandbox escape, allowing malicious WebAssembly modules to exfiltrate sensitive host data or corrupt host memory. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the CISA Known Exploited Vulnerabilities catalog and its inactive status on vulnerability hotlists. The EPSS score of 0.00014 reflects minimal real-world exploitation probability currently. However, the detailed technical description and specific conditions required for exploitation are documented, meaning motivated threat actors could theoretically develop proof-of-concept code. Organizations running vulnerable Wasmtime versions should prioritize patching to versions 36.0.7, 42.0.2, or 43.0.1.