CVE-2026-34944: Wasmtime Cranelift Passive Data Libcall Toctou

Using Cranelift built-in libcalls for Wasm passive data segments (`array.new_data`, `memory.init`, `data.drop`) is unsafe under asynchronous (fiber-based) execution. It creates a Time-of-Check to Time-of-Use (TOCTOU) vulnerability where bounds checks are performed before an implicit fiber yield, exposing segments to concurrent mutation or deletion. Inline bo

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0Rust^β