Two Critical Wasmtime Flaws Could Enable WebAssembly Sandbox Escape
Summary
Wasmtime maintainers disclosed two critical Cranelift flaws that could let attacker-controlled WebAssembly escape its sandbox. One affects ARM64; fixed releases are available, and maintainers have not reported attacks.
Key points
- Both flaws require an attacker-controlled WebAssembly module to be compiled by a vulnerable Wasmtime build; risk is greatest for services that compile modules supplied by others.
- CVE-2026-115889 involves overflow in Cranelift’s value tracking, which can produce incorrect machine code and type confusion in very large or specially crafted functions.
- CVE-2026-115893 affects ARM64: an oversized br_table could exceed branch reach and jump to the wrong location.
- Wasmtime 50.0.0 fixes both flaws. Other listed fixes include 36.0.19, 48.0.7, and 49.0.4; unsupported release lines received no fixes.
- Programs that embed Wasmtime as a library must be rebuilt with a fixed version; updating only the command-line tool is insufficient. The advisories list no workaround.
- Maintainers have not reported attacks. Until hosts are updated, the risk comes from modules an outsider can supply.
Article Details
- Vulnerability Types
- Cranelift value-number field overflow causing incorrect machine code and type confusion (CVE-2026-115889)
- ARM64 br_table branch-range error causing jumps to the wrong location and potentially arbitrary code execution (CVE-2026-115893)
- Severity
- Critical; maintainers rated each flaw 9.9 out of 10 on the CVSS scale.
- Affected Versions
- Wasmtime 36.0.7, 42.0.2, and 43.0.1 on ARM64 (CVE-2026-115893)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-115889As of October 26, GitHub's advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893. GitHub says only reviewed entries trigger Dependabot alerts, so Dependabot users should not expect anCVE-2026-115893ARM64 hosts that updated to 36.0.7, 42.0.2, or 43.0.1 in April to fix an earlier Cranelift sandbox escape on ARM64 are still affected by CVE-2026-115893.
Vendors
Products
CraneliftWasmtime runs WebAssembly code outside web browsers. Both bugs are in Cranelift, the compiler it uses by default to turn WebAssembly into machine code. Wasmtime's maintainers at the Bytecode Alliance rated each flaw 9.9WasmtimeTwo critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
Tools
cargo-auditBoth flaws are listed in RustSec, the database the cargo-audit tool uses to check Cargo.lock files, as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.SpinSpin, an open-source tool for building serverless WebAssembly apps that runs on Wasmtime, moved to Wasmtime 50.0.0 in version 4.2.4 on October 21.