When a Wasmtime instance compiles the f64x2.splat WebAssembly instruction on x86‑64 platforms with SSE3 disabled, Cranelift may generate code that accesses eight additional bytes beyond the intended boundary. If signals‑based traps are turned off, this out‑of‑bounds load can trigger an uncaught segmentation fault, causing the Wasmtime process to crash. Because the accidental load does not expose data to the WebAssembly guest, the flaw does not lead to data disclosure or arbitrary code execution, but it can be used to disrupt service by crashing the runtime.

Versions of Wasmtime earlier than 24.0.7, 36.0.7, 42.0.2, or 43.0.1 that run on x86‑64 processors with SSE3 disabled are affected. These include all releases in the 24, 36, 42, and 43 series before the specified patch points.

The CVSS score of 4.1 reflects moderate risk, emphasizing its denial‑of‑service impact rather than privilege escalation. No EPSS data or KEV listing is available, indicating limited public exploitation. Attackers would need the ability to execute Wasmtime with SSE3 disabled and signals‑based traps turned off; triggering the f64x2.splat instruction would then cause a crash. No active exploits have been reported, and the most likely vector is a remote service that intentionally disables SSE3 to run untrusted WebAssembly code.