The Wasmtime maintainers at the Bytecode Alliance have fixed two critical flaws in Cranelift, the compiler Wasmtime uses by default to turn WebAssembly into machine code. Each is rated 9.9 out of 10 on the CVSS scale. Both are miscompilation bugs: a malicious WebAssembly module can make Wasmtime generate code that lets the module step outside the limits the sandbox is supposed to enforce. CVE-2026-115889 (a bit-packing overflow in the compiler) affects all processor architectures, while CVE-2026-115893 (the wrong jump target on a large br_table instruction) affects only ARM64. The Hacker News reports that the maintainers have not seen attacks, and that neither flaw was in CISA’s Known Exploited Vulnerabilities catalog as of October 26.
The attacker has to get Wasmtime to compile a module they control, so the risk is highest for services that run code written by other people, such as edge platforms; The Hacker News cites Fastly, which says its Compute platform runs customer code on Wasmtime. The advisories do not say what an attacker could reach after escaping, and neither lists a workaround. Wasmtime is often built into other programs as a library, so updating the command-line tool does not fix those programs; each one has to be rebuilt with a fixed Wasmtime. An earlier Cranelift ARM64 sandbox escape was patched in April, and The Hacker News says hosts that took only those April releases are still affected by CVE-2026-115893.
How to check if you’re affected
Affected products are Wasmtime library and CLI builds, and any software or service that embeds them, on the version ranges below. Per The Hacker News, which tabulated the advisories (confirm against the GHSA pages linked under Sources):
- Versions before 36.0.19 (including the 24.x line): affected by both flaws. Update to 36.0.19, or move to 48.0.7, 49.0.4 or 50.0.0.
- Versions 37.0.0 through 42.x: affected by both. Move to 48.0.7, 49.0.4 or 50.0.0.
- Versions 43.0.0 through 47.x: affected by CVE-2026-115893 on ARM64 only. Move to 48.0.7, 49.0.4 or 50.0.0.
- Versions 48.0.0 to 48.0.6 and 49.0.0 to 49.0.3: affected on ARM64 only. Update to 48.0.7 or 49.0.4.
- Fixed: 36.0.19, 48.0.7, 49.0.4, and 50.0.0 or later (50.0.0 was released October 20).
Only the 36, 48, 49 and 50 release lines still receive security fixes, so a host on any other line, including the 24.x long-term line whose support ended August 20, 2026, has to move to a supported release. To find affected Rust projects, run cargo audit; the flaws are listed as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. The Hacker News notes that as of October 26 GitHub’s advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893, so Dependabot alerts may not cover the second one yet.
Sources
- GitHub advisory GHSA-897f-g5gm-fmxm (CVE-2026-115889): bit-packing in Cranelift causes silent overflow and miscompilation
- GitHub advisory GHSA-mghf-wjfp-p5xm (CVE-2026-115893): Cranelift aarch64 backend can jump to incorrect target on large
br_table - RUSTSEC-2026-0380 and RUSTSEC-2026-0379
- Wasmtime v50.0.0 release
- The Hacker News: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes