CVE-2026-115889criticalCWE-197CWE-843

CVE-2026-115889: critical vulnerability in bytecodealliance wasmtime

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Published · Updated

Follow this CVE+ Monitor wasmtime+ Monitor wasmtime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.9epss 0.5%
from disclosure to weapon4 days
Published on NVDOct 23
1st PoC+4d
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
bytecodealliance · wasmtime
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — bytecodealliance wasmtime

In the same product, most dangerous first.

CVE-2022-31104MEDIUMMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeEPSS 1.8%CVE-2023-26489CRITICALGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeEPSS 1.3%CVE-2022-31146MEDIUMUse After Free in WasmtimeEPSS 1.3%CVE-2022-24791HIGHUse after free in WasmtimeEPSS 1.2%CVE-2026-115893CRITICALWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionEPSS 1.0%CVE-2022-31169MEDIUMCranelift vulnerable to miscompilation of constant values in division on AArch64EPSS 0.9%