Two critical Wasmtime flaws let malicious WebAssembly modules escape the sandbox
Original title: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
CVE-2026-115889 affects every architecture and CVE-2026-115893 only ARM64; fixes landed October 19–20 with no attacks reported.
Bytecode Alliance maintainers disclosed two CVSS 9.9 Cranelift bugs that can let an attacker-controlled WebAssembly module escape Wasmtime’s sandbox. CVE-2026-115889 can cause type confusion on any architecture; CVE-2026-115893 can force arbitrary jumps on ARM64. Fixed releases are 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Maintainers have not reported attacks, and neither flaw was in CISA’s KEV catalog as of October 26.
Unconfirmed: Advisories do not name affected services or say what an attacker could access after escaping.
- Only the 36, 48, 49 and 50 release lines remain supported and received fixes.
- Unsupported lines, including 24.x LTS, received no patch.
- Embedded Wasmtime must be rebuilt; updating the CLI alone does not fix libraries.
- Neither advisory lists a workaround.
- RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379; Dependabot may miss the ARM64 flaw.
Impact: Attacker-controlled module can escape the Wasmtime sandbox
| Product | Affected | Fixed in |
|---|---|---|
| Bytecode Alliance Wasmtime | Before 36.0.19 (including 24.x) and 37.0.0 through 42.x for CVE-2026-115889 | 36.0.19, or 48.0.7, 49.0.4, or 50.0.0 |
| Bytecode Alliance Wasmtime (ARM64) | Before 36.0.19; 37.0.0 through 47.x; 48.0.0–48.0.6; 49.0.0–49.0.3 for CVE-2026-115893 | 36.0.19, 48.0.7, 49.0.4, or 50.0.0 |
- 1.Update supported lines to 36.0.19, 48.0.7, 49.0.4, or 50.0.0.
- 2.Rebuild every program that embeds Wasmtime as a library with a fixed version.
- 3.Check Cargo.lock with cargo-audit for RUSTSEC-2026-0380 and RUSTSEC-2026-0379.
- Vendors
- Bytecode Alliance
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-115893+1 related CVE | Wasmtime Cranelift sandbox escape on aarch64 | 9.9 | <1% | PoC |
From the original article
4 min read at thehackernews.com
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.