CVE-2026-115893
Wasmtime Cranelift on aarch64 jumps to wrong target on large br_table, sandbox escape
Wasmtime fixed CVE-2026-115893 on 19 October 2026. On ARM64 (aarch64), Cranelift can compile a Wasm br_table with more than about 256,000 targets so that a branch points to the wrong code. A user-controlled module can use this to escape the sandbox. Present since aarch64 support arrived in 2020. Fixed in 36.0.19, 48.0.7 and 49.0.4. Vendor CVSS 3.1 9.9. Not in CISA KEV. No known exploitation or public PoC.
By ThreatWire Desk · Published 19 Oct 2026 · Updated 26 Oct 2026
- CVSS
- 9.9
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Class
- Other
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Bytecode Alliance
- Products
- Wasmtime, Cranelift
- Affected
- wasmtime crate before 36.0.19, 37.0.0 up to (not including) 48.0.7, and 49.0.0 up to (not including) 49.0.4. Only aarch64 (ARM64) hosts using the Cranelift backend, which is the default. The advisory says every Wasmtime version with aarch64 support is affected, since that support first shipped in 2020, before Wasmtime 1.0.
- Fixed
- Wasmtime 36.0.19, 48.0.7 and 49.0.4 (19 October 2026). Wasmtime 50.0.0 (20 October 2026) also includes the fix.
- CWE
- CWE-691
- Published
- 19 Oct 2026
- Updated
- 26 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-115893 is a flaw in Cranelift, Wasmtime's default compiler, on ARM64 (aarch64) hosts only. The Bytecode Alliance published the advisory on 19 October 2026.
WebAssembly has an instruction called br_table that jumps to one of many places based on an index. On aarch64, Cranelift can compile a br_table with more than about 256,000 targets so that one conditional branch points to the wrong place.
The advisory says that branch can then jump to other code at an offset the module controls. That leads to an arbitrary sandbox escape. Any Wasmtime engine on aarch64 with default settings can be forced into this by a user-controlled Wasm module.
The bug is old. The advisory says every Wasmtime and Cranelift version that supports aarch64 is affected, since that support first shipped in 2020, before Wasmtime 1.0. It does not name the exact first release.
Fixed versions are 36.0.19, 48.0.7 and 49.0.4, all released on 19 October 2026. Wasmtime 50.0.0, released on 20 October, also lists the fix. The affected package is the wasmtime Rust crate, so apps that embed Wasmtime need to move to a fixed version.
The vendor rates it CVSS 3.1 9.9 (Critical). The full vector is in the CVSS field. NVD published its entry on 23 October 2026 with the vendor score only, and has not added its own score. The advisory credits the reporter as GitHub user ilyas-mallah.
The CVE is not in the CISA KEV catalog (catalog 2026.10.23, checked 26 October). The advisory lists no workaround. ThreatWire found no report of exploitation and no public proof of concept.
Read the full explainer. The twin flaw, which hits every architecture, is CVE-2026-115889.