Is CVE-2026-44216 actively exploited?

No active exploitation of CVE-2026-44216 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44216 be exploited remotely?

Yes. CVE-2026-44216 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44216?

CVE-2026-44216 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-44216

HIGH

CVE-2026-44216

CWE-770Published: May 14, 2026· Updated: May 18, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.8th

Official Description

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow. The panic happens when attempting to create a very large table, such as when instantiating a WebAssembly module or component. This vulnerability is fixed in 36.0.8, 43.0.2, and 44.0.1.

NVD Source

Technical Analysis

CVE-2026-44216 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.5.