CVE-2026-115893
Wasmtime is a runtime for WebAssembly
- Risk score
- 71/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in Wasmtime's Cranelift compiler backend on aarch64 allows a user-controlled Wasm module to escape the sandbox by jumping to arbitrary other code at a user-controlled offset.
- Affected
- {'products': ['Wasmtime'], 'packages': [], 'versions': ['Prior to 36.0.19, 48.0.7, and 49.0.4']}
- Fix
- Upgrade to versions 36.0.19, 48.0.7, and 49.0.4
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
References
- https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
- https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
- https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe
- https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
- https://github.com/bytecodealliance/wasmtime/pull/14818
- https://github.com/bytecodealliance/wasmtime/pull/14819
- https://github.com/bytecodealliance/wasmtime/pull/14820
- https://github.com/bytecodealliance/wasmtime/pull/14826
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
- https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7
Original description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Last activity 23 Oct 2026. Patch Forecast updates every hour.