CVE-2026-115889
published 2026-10-23CVE-2026-115889: Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently…
PriorityP262critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.45%
39.2th percentile
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | wasmtime | < 36.0.19 | 36.0.19 |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 0 < 36.0.19 | 36.0.19 |
| bytecodealliance | wasmtime | >= 37.0.0 < 43.0.0 | 43.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Bytecode Alliance Wasmtime up to 36.0.18/42.x Cranelift compiler backend indices type confusion (EUVD-2026-109186)
vuldb·2026-10-23·CVSS 9.9
CVE-2026-115889 [CRITICAL] Bytecode Alliance Wasmtime up to 36.0.18/42.x Cranelift compiler backend indices type confusion (EUVD-2026-109186)
A vulnerability was found in Bytecode Alliance Wasmtime up to 36.0.18/42.x. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Cranelift compiler backend. The manipulation of the argument indices leads to type confusion.
This vulnerability is documented as CVE-2026-115889. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
ghsa·2026-10-23
CVE-2026-115889 [CRITICAL] CWE-197 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
## Summary
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.
Cranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.
## Impact
A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experienc
No detection rules found.
No public exploits indexed.
https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aahttps://github.com/bytecodealliance/wasmtime/pull/12613https://github.com/bytecodealliance/wasmtime/pull/14818https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
2026-10-23
Published