Two critical Wasmtime Cranelift flaws let malicious WebAssembly modules escape the sandbox and run code

The Bytecode Alliance patched two critical flaws in Wasmtime's Cranelift compiler, CVE-2026-115889 affecting all architectures and CVE-2026-115893 affecting ARM64, both rated 9.9, that let a user-controlled WebAssembly module escape the sandbox and run arbitrary code. CVE-2026-115889 came from 24-bit value-tracking fields that overflowed silently and produced incorrect machine code, and CVE-2026-115893 let an oversized br_table jump to the wrong location on ARM64. Fixes are in versions 36.0.19, 48.0.7, 49.0.4, and 50.0.0, released October 20, which also refuse to compile a br_table with more than 65,520 targets. No exploitation has been reported.

Check

Identify software embedding Wasmtime or Cranelift, and upgrade to 36.0.19, 48.0.7, 49.0.4, or 50.0.0 depending on the branch in use.

Affected

Hosts running untrusted WebAssembly on affected Wasmtime versions can have a malicious module escape the Cranelift-compiled sandbox and execute arbitrary code.

Fix

Upgrade Wasmtime to a fixed release, rebuild and redeploy anything that bundles it, and restrict which WebAssembly modules untrusted parties can supply.