{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893) · updates",
  "home_page_url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893",
  "feed_url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/feed.json",
  "description": "Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported.",
  "language": "en",
  "_pwn": {
    "slug": "wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/feed.xml",
    "llms": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/llms.txt",
    "json": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-26-75334cb6",
      "url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-26-75334cb6",
      "title": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): The Hacker News reports on both flaws; GitHub's advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot may not alert on the ARM64 flaw. RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.",
      "content_text": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): The Hacker News reports on both flaws; GitHub's advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot may not alert on the ARM64 flaw. RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.\n\nSource: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-21-a52f3844",
      "url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-21-a52f3844",
      "title": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Spin 4.2.4 moves to Wasmtime 50.0.0.",
      "content_text": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Spin 4.2.4 moves to Wasmtime 50.0.0.\n\nSource: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "date_published": "2026-10-21T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-20-b9347932",
      "url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-20-b9347932",
      "title": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Wasmtime 50.0.0 is released, fixed for both flaws.",
      "content_text": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Wasmtime 50.0.0 is released, fixed for both flaws.\n\nSource: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "date_published": "2026-10-20T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-19-06d7c9eb",
      "url": "https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-19-06d7c9eb",
      "title": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Bytecode Alliance publishes GHSA-897f-g5gm-fmxm (CVE-2026-115889, Cranelift bit-packing overflow) and GHSA-mghf-wjfp-p5xm (CVE-2026-115893, aarch64 br_table jump), both rated critical 9.9, with fixed releases 36.0.19, 48.0.7 and 49.0.4.",
      "content_text": "Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Bytecode Alliance publishes GHSA-897f-g5gm-fmxm (CVE-2026-115889, Cranelift bit-packing overflow) and GHSA-mghf-wjfp-p5xm (CVE-2026-115893, aarch64 br_table jump), both rated critical 9.9, with fixed releases 36.0.19, 48.0.7 and 49.0.4.\n\nSource: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm",
      "tags": [
        "critical"
      ]
    }
  ]
}