CVE-2026-115889 Details
Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
A vulnerability exists in the Wasmtime runtime for WebAssembly, specifically in versions prior to 36.0.19 and 43.0.0. The issue arises in the Cranelift compiler backend, which bit-packs SSA value indices in a manner that can lead to silent overflows in release builds. This vulnerability can be exploited by compiling a large or specially crafted WebAssembly function that uses many SSA values. The overflow causes Cranelift to reference incorrect intermediate representation (IR) values, leading to arbitrary miscompilation, type confusion, and other effects controlled by the attacker, potentially escaping the WebAssembly sandbox on any architecture using the default Cranelift backend.
Users can upgrade to Wasmtime versions 36.0.19 or 43.0.0, both of which include the necessary fix. Instructions for downloading these versions are available on the Wasmtime GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0 | [email protected] | Source CodeVendor |
| https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa | [email protected] | Source CodeVendor |
| https://github.com/bytecodealliance/wasmtime/pull/12613 | [email protected] | Issue TrackingVendor |
| https://github.com/bytecodealliance/wasmtime/pull/14818 | [email protected] | Issue TrackingVendor |
| https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19 | [email protected] | Release NotesVendor |
| https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0 | [email protected] | Release NotesVendor |
| https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-197 | Numeric Truncation Error | [email protected] |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | < 36.0.19 (semver) >= 37.0.0 (semver) < 43.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |