Wasmtime flaws could let malicious WebAssembly escape sandboxes

Two critical flaws in Wasmtime, the WebAssembly runtime used to run Wasm code outside browsers, could let a malicious module escape its sandbox if it’s built into software and the attacker controls the module. The issues lie in Cranelift, Wasmtime’s default compiler, with both bugs rated 9.9/10 on CVSS by Wasmtime maintainers in advisories issued on 19 October 2026. One flaw (CVE-2026-115889) affects Wasmtime across all architectures, while the other (CVE-2026-115893) affects ARM64 (aarch64) only.

There have been no reported attacks as of 26 October 2026, and fixes were released on 19 and 20 October respectively. The U.S. CISA has not listed either vulnerability in its Known Exploited Vulnerabilities catalogue at that time.

The advisories describe how the sandbox can be bypassed when a module crafted by an attacker is executed. CVE-2026-115889 stems from 24-bit field packing in Cranelift’s tracking of values inside a function; before version 43, oversized numbers could overflow a field and lead to type confusion, enabling sandbox escape. Cranelift’s 32-bit widening implemented in Wasmtime 43.0.0 (24 February 2023) mitigates this in development, with the 36.x LTS receiving the same change on 19 October.

CVE-2026-115893 concerns br_table on ARM64, where out-of-range indexes could jump to an unintended target; the fix routes such indexes through the jump table and forbids overly large br_table targets. Affected users should upgrade to fixed releases: 36.0.19, 48.0.7, 49.0.4, or 50.0.0 (the latter released 20 October 2026). Because Wasmtime can be embedded as a library, each downstream program must rebuild with a fixed version. The advisories also note RustSec references and GitHub advisory coverage as of late October.