Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893) ยท updates https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported. en Mon, 26 Oct 2026 00:00:00 GMT Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): The Hacker News reports on both flaws; GitHub's advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot may not alert on the ARM64 flaw. RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-26-75334cb6 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html">Source</a></p> Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Spin 4.2.4 moves to Wasmtime 50.0.0. https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-21-a52f3844 Wed, 21 Oct 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html">Source</a></p> Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Wasmtime 50.0.0 is released, fixed for both flaws. https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-20-b9347932 Tue, 20 Oct 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html">Source</a></p> Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893): Bytecode Alliance publishes GHSA-897f-g5gm-fmxm (CVE-2026-115889, Cranelift bit-packing overflow) and GHSA-mghf-wjfp-p5xm (CVE-2026-115893, aarch64 br_table jump), both rated critical 9.9, with fixed releases 36.0.19, 48.0.7 and 49.0.4. https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893#2026-10-19-06d7c9eb Mon, 19 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm">Source</a></p>