Critical Wasmtime Cranelift Flaws Could Let Malicious WebAssembly Escape Sandboxes

The Bytecode Alliance patched two critical vulnerabilities in Cranelift, Wasmtime’s default compiler, that could allow attacker-controlled WebAssembly modules to escape the runtime’s sandbox. Both carry CVSS scores of 9.9. CVE-2026-115889 affects all processor architectures and involves bit-packing overflow and miscompilation; CVE-2026-115893 affects ARM64 and can cause large WebAssembly branch-table instructions to jump to incorrect targets. Exploitation requires a vulnerable Wasmtime build to compile a malicious module, making multi-tenant platforms and services accepting externally supplied modules the most exposed.

Fixed releases include Wasmtime 36.0.19, 48.0.7, 49.0.4, and 50.0.0. Organizations should upgrade embedded Wasmtime dependencies, rebuild and redeploy affected applications, and recompile cached modules; updating only the command-line tool does not fix applications embedding the runtime. As of October 26, reporting identified no public proof-of-concept exploits or known in-the-wild exploitation, and neither vulnerability appeared in CISA’s Known Exploited Vulnerabilities catalog.