Cranelift
Security incidents tagged Cranelift. Newest first.
1 Cranelift incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 7
- Longest quiet run: 4 days (Oct 22–Oct 25)
- Patched
Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893)
Two CVSS 9.9 bugs in Cranelift, the default compiler in the Wasmtime WebAssembly runtime, let a module an attacker controls escape its sandbox. CVE-2026-115889 (all architectures) comes from 24-bit value-number fields that silently overflowed in large functions, causing miscompilation and type confusion; it affects Wasmtime before 36.0.19 and 37.0.0 through 42.x. CVE-2026-115893 (ARM64/aarch64 only) makes a br_table with more than about 256,000 targets jump to the wrong place, letting a module jump to arbitrary code; it affects every line before 36.0.19, 48.0.7 and 49.0.4. Fixes shipped Oct 19 and 20 in 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Wasmtime is often embedded as a library, so every program that bundles it must be rebuilt; services that compile modules from untrusted users are most at risk. No exploitation reported.
Wasmtime (Bytecode Alliance) and its Cranelift compilerSince Oct 19, 2026
