Loading vulnerability…
Wasmtime Cranelift SSA Index Truncation and Sandbox Escape
CVE-2026-115889 is a numeric truncation vulnerability in Wasmtime's default Cranelift compiler backend. Cranelift stores static single-assignment (SSA) value indices in bit-packed 24-bit fields that can silently overflow in release builds when compiling sufficiently large or specially crafted WebAssembly functions containing many SSA values. Truncated indices can reference incorrect intermediate-representation values, producing arbitrary miscompilation, type confusion, and attacker-controlled effects that may escape the WebAssembly sandbox. The vulnerability affects all processor architectures using the vulnerable Cranelift backend in Wasmtime releases before 36.0.19 and releases 37.0.0 through 42.x. Wasmtime 36.0.19 and versions 43.0.0 onward are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malicious WebAssembly modules can cause unsafe native-code generation and potentially break Wasmtime's sandbox isolation, allowing code execution outside the intended WebAssembly environment. A successful escape could compromise the host process and expose or modify application or other tenants' data, depending on the embedding application's privileges and workload isolation. Confidentiality, integrity, and availability may all be affected. A complete post-escape attack chain has not been demonstrated in the available information.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Pending an upgrade, restrict or suspend compilation of untrusted WebAssembly modules, authenticate and review module submissions, and reject unusually large modules or functions. These measures reduce exposure but are not guaranteed to prevent specially crafted inputs. Run embedding applications with least privilege and strong operating-system isolation to limit the consequences of a sandbox escape.
Patch, then assume compromise.
Upgrade affected 36.x deployments to Wasmtime 36.0.19 or a later fixed 36.x release, or migrate to a supported release at version 43.0.0 or later. Deployments on versions 37.0.0 through 42.x must migrate to a fixed release. The fix replaces 24-bit packed indices with full 32-bit indices and checks for exceeding the supported limit. Inventory embedded and bundled Wasmtime dependencies, update dependencies and lockfiles, and rebuild and redeploy every embedding application; updating only the standalone runtime does not update embedded copies. Recompile cached or precompiled modules using the fixed compiler because existing machine code can retain unsafe compiler output.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.