Two critical Wasmtime flaws let malicious WebAssembly modules escape the sandbox
CVE-2026-115889 affects every architecture and CVE-2026-115893 only ARM64; fixes landed October 19–20 with no attacks reported.
64
CVE-2026-115889
Cranelift SSA index overflow in Wasmtime before 36.0.19 and 43.0.0
- CVSS 3.1
- 9.9 critical
- EPSS
- <1%p40
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Wasmtime’s default Cranelift compiler bit-packs SSA value indices that can silently overflow in release builds when compiling a large or specially crafted WebAssembly function. A low-privileged attacker who supplies that module can trigger the overflow over the network with no user interaction. Miscompilation and type confusion may let effects escape the Wasm sandbox on any architecture using Cranelift. Versions before 36.0.19 and 43.0.0 are affected.
What to do: Upgrade Wasmtime to 36.0.19 or 43.0.0, which fix the Cranelift SSA index overflow.
| Product | Affected | Fixed in |
|---|---|---|
| Wasmtime | prior to 36.0.19 and 43.0.0 | 36.0.19 and 43.0.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
- Ecosystems
- rust
- Weakness
- CWE-197, CWE-843
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- GHSA
- GHSA-897f-g5gm-fmxm (critical)