CVE-2026-24116: Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64
(updated )
On x86-64 platforms with AVX Wasmtime’s compilation of the f64.copysign WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When [signals-based-traps] are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it’s possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests.
References
- docs.rs/wasmtime/latest/wasmtime/struct.Config.html
- docs.rs/wasmtime/latest/wasmtime/struct.Config.html
- docs.wasmtime.dev/stability-release.html
- github.com/advisories/GHSA-vc8c-j3xm-xj73
- github.com/bytecodealliance/wasmtime
- github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6
- github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440
- github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227
- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73
- nvd.nist.gov/vuln/detail/CVE-2026-24116
- rustsec.org/advisories/RUSTSEC-2026-0006.html
Code Behaviors & Features
Detect and mitigate CVE-2026-24116 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →