Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893)

Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported.

Why this severity: CVSS 9.9 each per the Bytecode Alliance advisories; needs an attacker-supplied module compiled by a vulnerable build; no reported exploitation and not in CISA KEV as of Oct 26

Started

Oct 19, 2026

CVEs

CVE-2026-115889CVE-2026-115893

• Rust
• #Wasmtime
• #WebAssembly
• #Cranelift
• #Bytecode Alliance
• #Sandbox Escape
• #ARM64