CVE-2026-115893criticalCWE-691

CVE-2026-115893: falha crítica em bytecodealliance wasmtime

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar wasmtime+ Monitorar wasmtime

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.9epss 1.0%
da publicação à arma4 dias
Publicada no NVD23 de out.
1ª PoC+4d
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
bytecodealliance · wasmtime
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — bytecodealliance wasmtime

No mesmo produto, das mais perigosas para as menos.

CVE-2022-31104MEDIUMMiscompilation of `i8x16.swizzle` and `select` with v128 inputs in WasmtimeEPSS 1.8%CVE-2023-26489CRITICALGuest-controlled out-of-bounds read/write on x86_64 in wasmtimeEPSS 1.3%CVE-2022-31146MEDIUMUse After Free in WasmtimeEPSS 1.3%CVE-2022-24791HIGHUse after free in WasmtimeEPSS 1.2%CVE-2022-31169MEDIUMCranelift vulnerable to miscompilation of constant values in division on AArch64EPSS 0.9%CVE-2024-51745LOWWasmtime doesn't fully sandbox all the Windows device filenamesEPSS 0.8%