CVE-2026-115889 · GHSA-897f-g5gm-fmxm
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- Risk score
- 70/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Cranelift compiler backend of Wasmtime allows attackers to cause silent overflow and miscompilation, potentially escaping the Wasm sandbox. This can lead to arbitrary miscompilation, type confusion, and other attacker-controlled effects.
- Affected
- {'products': ['Wasmtime'], 'packages': [{'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '< 36.0.19', 'patched': '36.0.19'}, {'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '>= 37.0.0, < 43.0.0', 'patched': '43.0.0'}], 'versions': ['< 36.0.19', '>= 37.0.0, < 43.0.0']}
- Fix
- Upgrade to version 36.0.19 or 43.0.0
- Exploitation
- No known exploitation
Story map
At a glance
wasmtime: Amber, patch this week. A vulnerability in the Cranelift compiler backend of Wasmtime allows attackers to cause silent overflow and miscompilation, potentially escaping the Wasm sandbox. This can lead to arbitrary miscompilation, type confusion, and other attacker-controlled effects.
The flaws
- CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9 · EPSS 1%)
- CVE-2026-115892: Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7 · EPSS 1%)
The fix
Upgrade wasmtime: 36.0.19 · 43.0.0 · 48.0.7 · 49.0.4 or later on your release line
Who is exposed: {'products': ['Wasmtime'], 'packages': [{'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '< 36.0.19', 'patched': '36.0.19'}, {'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '>= 37.0.0, < 43.0.0', 'patched': '43.0.0'}], 'versions': ['< 36.0.19', '>= 37.0.0, < 43.0.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-197 (CWE-197). 16 other warnings in 30 days
Why it is Amber
- CVSS 9.9 critical
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| wasmtime | rust | < 36.0.19 | 36.0.19 |
| wasmtime | rust | >= 37.0.0, < 43.0.0 | 43.0.0 |
References
- https://github.com/advisories/GHSA-897f-g5gm-fmxm
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
- https://github.com/bytecodealliance/wasmtime/pull/12613
- https://github.com/bytecodealliance/wasmtime/pull/14818
- https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
- https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
- https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
- https://rustsec.org/advisories/RUSTSEC-2026-0380.html
- https://github.com/advisories/GHSA-897f-g5gm-fmxm
Original description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Last activity 23 Oct 2026. Patch Forecast updates every hour.