Wasmtime — Two Critical Cranelift Sandbox Escape Flaws (CVE-2026-115889 and CVE-2026-115893)

Publication date: October 26, 2026
Category: Vulnerability / Software Security

Introduction

Project maintainers of Wasmtime have disclosed two critical security vulnerabilities affecting the WebAssembly (Wasm) runtime engine. The flaws, tracked as CVE-2026-115889 and CVE-2026-115893, allow an attacker-controlled, malicious WebAssembly module to escape the isolation sandbox enforced by the architecture. Exploitation requires an attacker to compile and supply a crafted module through an application embedding Wasmtime, posing a particularly high risk to cloud compute platforms executing multi-tenant code, such as Fastly Compute. Patched versions were released by the Bytecode Alliance in mid-October 2026.

What is Wasmtime and Cranelift? (General Analysis)

Wasmtime is a standalone, high-performance runtime engine for WebAssembly operating outside web browsers, designed to execute portable code natively across various server environments and hardware architectures. The engine leverages the Cranelift compiler by default to translate WebAssembly bytecode into optimized machine code. Wasmtime’s security sandbox ensures that any executed module remains strictly confined to its private memory space and explicitly authorized host functions, while restricting code jumps to verified locations.

Both vulnerabilities have been officially rated with critical severity scores under the CVSS v3.1 framework:

  • CVE-2026-115889: CVSS score of 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE classification: CWE-197 (Numeric Truncation Error) and CWE-843 (Access to Resource Using Incompatible Type / Type Confusion). Confirmed via official NVD records.
  • CVE-2026-115893: CVSS score of 9.9 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE classification: CWE-691 (Insufficient Control Flow Management). Confirmed via official NVD records.

How Does It Work? (Technical Analysis)

The compromise stems from logic flaws and overflow management issues within the Cranelift compiler backend:

  • Infection Flow and Entry Vectors: An external user or attacker supplies a customized WebAssembly module to be compiled by a host running Wasmtime. Exploitation requires no prior underlying OS privileges, only the capability to submit Wasm code for compilation.
  • Mechanism of CVE-2026-115889 (SSA Overflow in Cranelift): Earlier versions of the compiler packed Static Single Assignment (SSA) value indices into 24-bit fields. When compiling excessively large Wasm functions or modules specially crafted with numerous SSA values, release builds suffered a silent numeric overflow without raising errors. Consequently, Cranelift referenced incorrect Intermediate Representation (IR) values, yielding arbitrary miscompilations, type confusions, and attacker-controlled sandbox escapes across all architectures.
  • Mechanism of CVE-2026-115893 (br_table Branch Overflow on ARM64): This flaw affects ARM64 (aarch64) architectures exclusively. The WebAssembly br_table instruction performs conditional jumps based on an index across multiple targets. On ARM64, Cranelift dispatched out-of-range indices to the default target using a conditional branch limited to a reach of approximately 1 MiB. Processing jump tables exceeding roughly 256,000 targets exceeded this reach, causing the branch to silently point to an incorrect memory location, allowing user-controlled modules to jump to arbitrary code.

Affected Systems / Environments

Impact spans multiple release lines of Wasmtime and specific hardware configurations:

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-115889 CWE-197, CWE-843 Sandbox escape on any architecture 9.9 (CRITICAL) AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-115893 CWE-691 Sandbox escape on ARM64 (aarch64) 9.9 (CRITICAL) AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Affected Release Lines:
    • Versions prior to 36.0.19 (affected by both CVEs).
    • Lines between 37.0.0 and 42.x (affected by both CVEs).
    • Lines 43.0.0 through 47.x (affected by CVE-2026-115893 on ARM64).
    • Lines 48.0.0 to 48.0.6 and 49.0.0 to 49.0.3 (affected by CVE-2026-115893 on ARM64).
  • LTS Status: The 24.x LTS line reached end-of-life on August 20, 2026, and received no backported fixes.
  • At-Risk Environments: Serverless platforms, WebAssembly infrastructure tooling such as Spin (prior to version 4.2.4), and cloud services executing untrusted customer code.

Mitigation and Detection

Remediation

Because Wasmtime is embedded as a library within software applications, updating generic command-line tools is insufficient. Every application incorporating Wasmtime must be rebuilt using patched versions:

  • Upgrade to patched stable release lines: 36.0.19, 48.0.7, 49.0.4, or major version 50.0.0 (and later).
  • For Rust dependencies, inspect Cargo.lock files using cargo-audit, which flags these vulnerabilities under identifiers RUSTSEC-2026-0380 and RUSTSEC-2026-0379.

Detection

Defensive teams should audit Software Bills of Materials (SBOMs) to pinpoint software utilizing vulnerable Wasmtime builds across x86_64 and ARM64 architectures. Monitoring should also focus on compilation requests involving overly complex Wasm modules or anomalous jump tables.

“Executing multi-tenant WebAssembly relies on strict sandboxed isolation; compiler JIT flaws in Cranelift demonstrate how intermediate representation numeric overflows can completely break host privilege boundaries.”

Wrapping Up

Vulnerabilities CVE-2026-115889 and CVE-2026-115893 underscore the inherent risks associated with Just-In-Time (JIT) and intermediate representation compilers handling untrusted inputs within isolation boundaries. The swift response from the Bytecode Alliance highlights the vital necessity of rigorous dependency management in modern WebAssembly and serverless ecosystems.

References