CVE-2026-115889
Wasmtime Cranelift SSA index overflow leads to miscompilation and sandbox escape
Wasmtime fixed CVE-2026-115889 on 19 October 2026. Before Wasmtime 43, the Cranelift compiler packed its SSA value indices into fields that can silently overflow in release builds. A very large or crafted Wasm function can then be miscompiled and escape the sandbox, on any architecture. Fixed in 36.0.19 and 43.0.0. Vendor CVSS 3.1 9.9. Not in CISA KEV. No known exploitation or public PoC.
By ThreatWire Desk · Published 19 Oct 2026 · Updated 26 Oct 2026
- CVSS
- 9.9
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Class
- Other
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Bytecode Alliance
- Products
- Wasmtime, Cranelift
- Affected
- wasmtime crate before 36.0.19, and 37.0.0 up to (not including) 43.0.0. Component: the Cranelift compiler backend, used by default. All architectures and platforms. Wasmtime 43.0.0 and later (including the 48.x and 49.x lines) are not affected by this flaw.
- Fixed
- Wasmtime 36.0.19 (19 October 2026) and 43.0.0 (20 March 2026). Wasmtime 48.0.7, 49.0.4 and 50.0.0 also fix the twin flaw CVE-2026-115893.
- Published
- 19 Oct 2026
- Updated
- 26 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-115889 is a flaw in Cranelift, the compiler that Wasmtime uses by default to turn WebAssembly into machine code. The Bytecode Alliance published the advisory on 19 October 2026.
Cranelift tracks the values inside a function with numbered indices. Before Wasmtime 43, it packed those numbers into fields that could silently overflow in release builds. Cranelift could then point at the wrong value and produce wrong machine code.
The advisory says a very large Wasm function, or one crafted to use many values, can use this to force type confusion and escape the sandbox. It applies to a Wasmtime engine with default settings on any architecture or platform.
The flaw was removed from the main line before it was known as a security bug. Pull request 12613, merged on 18 February 2026, widened the indices to full 32-bit values with limit checks. It shipped in Wasmtime 43.0.0 on 20 March 2026. The 36.x line got the fix in 36.0.19 on 19 October 2026.
Affected: versions before 36.0.19, and 37.0.0 up to 43.0.0. The 48.x, 49.x and 50.x lines are not affected by this flaw. The affected package is the wasmtime Rust crate, so apps that embed Wasmtime need to move to a fixed version.
The vendor rates it CVSS 3.1 9.9 (Critical). The full vector is in the CVSS field. NVD published its entry on 23 October 2026 with the vendor score only, and has not added its own score. The advisory credits the reporter as GitHub user jaydns.
The CVE is not in the CISA KEV catalog (catalog 2026.10.23, checked 26 October). The advisory lists no workaround. ThreatWire found no report of exploitation and no public proof of concept.
Read the full explainer. The twin flaw is the ARM64-only CVE-2026-115893.