This flaw occurs in the Wasmtime runtime when compiling the WebAssembly instruction f64.copysign on x86‑64 machines that support AVX. The generated code may load eight bytes beyond the intended operand, which can trigger an uncaught segfault if signals‑based‑traps are disabled, or may cause data from outside the sandbox to be read when guard pages are disabled. The crash represents a denial‑of‑service attack; the out‑of‑bounds read does not leak guest memory because the extra load is not visible to WebAssembly modules, making it a classic out‑of‑bounds read weakness (CWE‑125).

The issue applies to the bytecodealliance Wasmtime runtime on x86‑64 platforms with AVX support. Vulnerable versions span from 29.0.0 up to, but not including, the patched releases 36.0.5, 40.0.3, and 41.0.1. Users should update to one of those releases or to a later major version that contains the fix.

With a CVSS score of 4.1 the severity is low, and an EPSS score of less than 1 % indicates a very low probability of exploitation. The defect causes a process crash rather than allowing remote code execution or memory disclosure; thus the overall risk is mild. No CISA KEV listing is present. The attack vector is local—any component that feeds WebAssembly code into Wasmtime can trigger the failure if signals‑based‑traps are disabled or guard pages are turned off.