# Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893) · pwn.watch > Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported. Page: https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 · generated 2026-10-26T16:03:32.143Z ## Status - Severity: critical · status: live · patch: patched - Product: Wasmtime (Bytecode Alliance) and its Cranelift compiler - Started: 2026-10-19 - CVEs: CVE-2026-115889, CVE-2026-115893 - Affected: wasmtime before 36.0.19, and 37.0.0 to before 43.0.0 (CVE-2026-115889, any architecture); wasmtime before 36.0.19, 37.0.0 to before 48.0.7, and 49.0.0 to before 49.0.4 on aarch64 (CVE-2026-115893); Unsupported lines (including 24.x LTS) get no fix; ARM64 hosts on 36.0.7, 42.0.2 or 43.0.1 from the April Cranelift fix are still affected by CVE-2026-115893 - Fixed in: wasmtime 36.0.19; wasmtime 48.0.7; wasmtime 49.0.4; wasmtime 50.0.0; Spin 4.2.4 (moves to Wasmtime 50.0.0) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/feed.xml - JSON Feed: https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893.json - This file: https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893/llms.txt ## Updates (newest first) - 2026-10-26: The Hacker News reports on both flaws; GitHub's advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot may not alert on the ARM64 flaw. RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. (https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html) - 2026-10-21: Spin 4.2.4 moves to Wasmtime 50.0.0. (https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html) - 2026-10-20: Wasmtime 50.0.0 is released, fixed for both flaws. (https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html) - 2026-10-19: Bytecode Alliance publishes GHSA-897f-g5gm-fmxm (CVE-2026-115889, Cranelift bit-packing overflow) and GHSA-mghf-wjfp-p5xm (CVE-2026-115893, aarch64 br_table jump), both rated critical 9.9, with fixed releases 36.0.19, 48.0.7 and 49.0.4. (https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm) ## Fix brief # Security brief: Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893) Source: https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893 · status: live · severity: critical · updated Oct 26, 2026, 13:36 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported. Severity detail: CVSS 9.9 each per the Bytecode Alliance advisories; needs an attacker-supplied module compiled by a vulnerable build; no reported exploitation and not in CISA KEV as of Oct 26 - Product: Wasmtime (Bytecode Alliance) and its Cranelift compiler - CVE / advisory ids: CVE-2026-115889, CVE-2026-115893 ## Affected versions - wasmtime before 36.0.19, and 37.0.0 to before 43.0.0 (CVE-2026-115889, any architecture) - wasmtime before 36.0.19, 37.0.0 to before 48.0.7, and 49.0.0 to before 49.0.4 on aarch64 (CVE-2026-115893) - Unsupported lines (including 24.x LTS) get no fix; ARM64 hosts on 36.0.7, 42.0.2 or 43.0.1 from the April Cranelift fix are still affected by CVE-2026-115893 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - wasmtime 36.0.19 - wasmtime 48.0.7 - wasmtime 49.0.4 - wasmtime 50.0.0 - Spin 4.2.4 (moves to Wasmtime 50.0.0) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Latest updates - Oct 26, 2026: The Hacker News reports on both flaws; GitHub's advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot may not alert on the ARM64 flaw. RustSec lists them as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. - Oct 21, 2026: Spin 4.2.4 moves to Wasmtime 50.0.0. - Oct 20, 2026: Wasmtime 50.0.0 is released, fixed for both flaws. - Oct 19, 2026: Bytecode Alliance publishes GHSA-897f-g5gm-fmxm (CVE-2026-115889, Cranelift bit-packing overflow) and GHSA-mghf-wjfp-p5xm (CVE-2026-115893, aarch64 br_table jump), both rated critical 9.9, with fixed releases 36.0.19, 48.0.7 and 49.0.4. ## Advisories - [GHSA-897f-g5gm-fmxm: Bit-packing in Cranelift compiler causes silent overflow and miscompilation](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm) (Bytecode Alliance) - [GHSA-mghf-wjfp-p5xm: Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm) (Bytecode Alliance) ## Write-ups & news - [Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes](https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html) --- Machine-readable: https://pwn.watch/i/wasmtime-cranelift-sandbox-escapes-cve-2026-115889-115893.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.