UBUNTU-CVE-2026-34944

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-34944

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-34944.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-34944

Upstream

CVE-2026-34944

Published

2026-04-09T19:16:00Z

Modified

2026-04-16T09:13:14Z

Severity

4.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

References

Affected packages

Ubuntu:24.04:LTS / rust-wasmtime

Package

Name: rust-wasmtime
Purl: pkg:deb/ubuntu/rust-wasmtime@16.0.0+dfsg-3?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.0.1+dfsg-7

15.*

15.0.1+dfsg-4

16.*

16.0.0+dfsg-2

16.0.0+dfsg-3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.103.0+16.0.0+dfsg-3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-34944.json"

Ubuntu:25.10 / rust-wasmtime