Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

🗓️ 27 Jan 2026 00:48:20Reported by GitHub Advisory DatabaseType

Wasmtime on x86-64 AVX may load 16 bytes for f64.copysign, causing segfaults or out-of-sandbox data.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2026-24116	27 Jan 202618:58	–	attackerkb
CBLMariner	CVE-2026-24116 affecting package rust for versions less than 1.75.0-25	10 Mar 202622:56	–	cbl_mariner
CBLMariner	CVE-2026-24116 affecting package rust for versions less than 1.90.0-4	10 Mar 202622:56	–	cbl_mariner
Chainguard	CVE-2026-24116 vulnerabilities	28 Jan 202601:17	–	cgr
CNNVD	WasmTime buffer error vulnerability	27 Jan 202600:00	–	cnnvd
CVE	CVE-2026-24116	27 Jan 202618:58	–	cve
Cvelist	CVE-2026-24116 Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64	27 Jan 202618:58	–	cvelist
Debian CVE	CVE-2026-24116	27 Jan 202618:58	–	debiancve
EUVD	EUVD-2026-4773	27 Jan 202618:58	–	euvd
NVD	CVE-2026-24116	27 Jan 202619:16	–	nvd

Vulners

Node

bytecodealliance wasmtimeRange37.0.0–40.0.3rust

bytecodealliance wasmtimeRange29.0.0–36.0.5rust

Source	Link
github	www.github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73
github	www.github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6
github	www.github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440
github	www.github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227
docs	www.docs.rs/wasmtime/latest/wasmtime/struct.Config.html
docs	www.docs.rs/wasmtime/latest/wasmtime/struct.Config.html
docs	www.docs.wasmtime.dev/stability-release.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24116
rustsec	www.rustsec.org/advisories/RUSTSEC-2026-0006.html
github	www.github.com/advisories/GHSA-vc8c-j3xm-xj73

29 Jan 2026 03:28Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.5

CVSS 44.1

EPSS0.00011

SSVC