Is CVE-2026-34944 actively exploited?

No active exploitation of CVE-2026-34944 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34944 be exploited remotely?

No. CVE-2026-34944 requires local access to exploit.

What is the CVSS score of CVE-2026-34944?

CVE-2026-34944 has a CVSS score of 4.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34944

MEDIUM

CVE-2026-34944

CWE-248Published: April 9, 2026· Updated: Apr 13, 2026

4.1

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but this data is not visible to WebAssembly guests. This vulnerability is fixed in 24.0.7, 36.0.7, 42.0.2, and 43.0.1.

NVD Source

Technical Analysis

CVE-2026-34944 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionA

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X