# RUSTSEC-2026-0004 - Triton VM Soundness Vulnerability due to Improper Sampling of Randomness

Source: https://junglewise.ai/threats/rustsec-2026-0004-triton-vm-soundness-vulnerability-due-to-improper-bb72e8ec  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-01-21

Triton VM Soundness Vulnerability due to Improper Sampling of Randomness

Technologies: [triton-vm (crates.io)](https://junglewise.ai/threats/technologies/triton-vm). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 21 January 2026.

**Which products and versions are affected?** triton-vm (crates.io) SEMVER:introduced=0.41.0,fixed=2.0.0.

**Is there a fix for This vulnerability?** Yes. triton-vm (crates.io): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run triton-vm (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- triton-vm (crates.io): upgrade to 2.0.0 or later

  ```sh
  cargo update -p triton-vm
  ```


## Affected products

- triton-vm (crates.io) SEMVER:introduced=0.41.0,fixed=2.0.0

## Related threats

- [Triton VM missing constraint in sponge_absorb_mem instruction](https://junglewise.ai/threats/triton-vm-missing-constraint-in-sponge-absorb-mem-instruction-1db6e865)
- [Triton VM has a Soundness Vulnerability due to Improper Sampling of Randomness](https://junglewise.ai/threats/triton-vm-has-a-soundness-vulnerability-due-to-improper-sampling-of-1d1cee44)
- [RUSTSEC-2021-0156 - Triton VM Soundness Vulnerability due to Missing Constraint](https://junglewise.ai/threats/rustsec-2021-0156-triton-vm-soundness-vulnerability-due-to-missing-78c4ef29)