CVE-2026-115893criticalCWE-691

CVE-2026-115893: critical vulnerability in bytecodealliance wasmtime

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Published · Updated

Follow this CVE+ Monitor wasmtime+ Monitor wasmtime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.9epss 1.0%
from disclosure to weapon4 days
Published on NVDOct 23
1st PoC+4d
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
bytecodealliance · wasmtime
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — bytecodealliance wasmtime

In the same product, most dangerous first.

CVE-2022-31104MEDIUMMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeEPSS 1.8%CVE-2023-26489CRITICALGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeEPSS 1.3%CVE-2022-31146MEDIUMUse After Free in WasmtimeEPSS 1.3%CVE-2022-24791HIGHUse after free in WasmtimeEPSS 1.2%CVE-2022-31169MEDIUMCranelift vulnerable to miscompilation of constant values in division on AArch64EPSS 0.9%CVE-2024-51745LOWWasmtime doesn't fully sandbox all the Windows device filenamesEPSS 0.8%