Two Critical Wasmtime Flaws Let WebAssembly Escape Sandboxes
Two critical Cranelift bugs in Wasmtime, CVE-2026-115889 and CVE-2026-115893, could let a malicious WebAssembly module break out of its sandbox. Fixed versions are out, and this guide shows who is affected and how to check.
Short answer: Two critical Wasmtime flaws, CVE-2026-115889 and CVE-2026-115893, could let a malicious WebAssembly module escape its sandbox. Both are rated 9.9 out of 10. Update to Wasmtime 36.0.19, 48.0.7, 49.0.4 or 50.0.0, and rebuild any program that embeds Wasmtime.
Two critical flaws in Wasmtime could let a malicious WebAssembly module escape the sandbox meant to contain it. Fixed versions came out on October 19 and 20, and you should update any host that compiles modules from other people. Maintainers have not reported any attacks.
What happened
Wasmtime is a WebAssembly runtime that runs code outside web browsers. Other software can embed it. Both bugs sit in Cranelift, the compiler Wasmtime uses by default to turn WebAssembly into machine code. The Bytecode Alliance published advisories on October 19. (The Hacker News report)
CVE-2026-115889 affects Wasmtime on all processor architectures.
CVE-2026-115893 affects only ARM64, also called aarch64.
The first bug comes from how Cranelift tracked values inside a function. Before version 43, it packed those numbers into 24-bit fields. In release builds, a number too large for its field overflowed silently. Cranelift could then refer to the wrong value and produce incorrect machine code. A very large function, or one built to use many values, can use this to force type confusion and escape the sandbox.
The second bug involves br_table, a WebAssembly instruction that jumps to one of many places based on an index. On ARM64, Cranelift sent out-of-range indexes to the default target with a branch that reaches only about 1 MiB. A br_table with more than about 256,000 targets made the jump table too big for that reach. The branch then pointed to the wrong place. The advisory says a default-settings engine on ARM64 "can be forced to jump to arbitrary code by a user-controlled Wasm module." The bug has existed since Wasmtime first supported ARM64 in 2020.
Who is affected
Your exposure depends on your release line and, for one flaw, your CPU architecture. This table comes from the report.
Wasmtime version | CVE-2026-115889 (any architecture) | CVE-2026-115893 (ARM64 only) | What to do |
|---|---|---|---|
Before 36.0.19 (includes 24.x) | Affected | Affected | Update to 36.0.19, or move to 48.0.7, 49.0.4 or 50.0.0 |
36.0.19 | Fixed | Fixed | None needed for these flaws |
37.0.0 through 42.x | Affected | Affected | Move to 48.0.7, 49.0.4 or 50.0.0 |
43.0.0 through 47.x | Not affected | Affected | Move to 48.0.7, 49.0.4 or 50.0.0 |
48.0.0 through 48.0.6 | Not affected | Affected | Update to 48.0.7 |
48.0.7 | Not affected | Fixed | None needed for these flaws |
49.0.0 through 49.0.3 | Not affected | Affected | Update to 49.0.4 |
49.0.4, and 50.0.0 or later | Not affected | Fixed | None needed for these flaws |
Only the 36, 48, 49 and 50 lines are still supported. Every other line got no fix, including the 24.x LTS line, whose support ended on August 20, 2026. ARM64 hosts that updated to 36.0.7, 42.0.2 or 43.0.1 in April for an earlier Cranelift escape are still affected by CVE-2026-115893.
Worked example: a service runs Wasmtime 47.0.1 on an aarch64 server. It is not hit by CVE-2026-115889, but it is hit by CVE-2026-115893. The same build on x86_64 avoids both flaws, yet 47.x is unsupported, so plan a move to 48.0.7, 49.0.4 or 50.0.0 anyway.
How serious it is and whether it is exploited
The Bytecode Alliance rated each flaw 9.9 out of 10 on the CVSS scale. An attacker first needs a vulnerable Wasmtime build to compile a module they control. So the risk is highest for services that compile modules written by other people. Fastly, for example, says its Compute platform runs customer code using Wasmtime.
The maintainers have not reported any attacks. As of October 26, neither flaw was in CISA's Known Exploited Vulnerabilities catalog. That can change, so treat the patch as routine but prompt work, not an optional cleanup.
What to do now
Update to the fixed release for your line: 36.0.19, 48.0.7 or 49.0.4. Wasmtime 50.0.0, released on October 20, fixes both flaws. Neither advisory lists a workaround. Until you update, the risk comes from any module an outsider can supply. Avoid compiling outside modules on unpatched hosts.
Wasmtime can be built into other programs as a library. Updating the command-line tool does not fix those programs. Rebuild each program that includes Wasmtime with a fixed version.
Check your exposure
First, check the CPU architecture and the CLI version on each host:
uname -m
wasmtime --versionIf uname -m prints aarch64 (or arm64 on macOS), both flaws can apply. Next, find Wasmtime inside Rust projects:
cargo tree -i wasmtime
grep -A1 'name = "wasmtime"' Cargo.lockFinally, scan your lockfile with the RustSec database. Both flaws are listed there as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.
cargo install cargo-audit --locked
cargo auditDo not rely on Dependabot for the ARM64 flaw
As of October 26, GitHub's advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893. Only reviewed entries trigger Dependabot alerts, so you may get no alert for the ARM64 flaw. Use cargo audit and the version table above instead.
Patch checklist
List every host and container that runs Wasmtime, and note its architecture.
Map each version to the table and pick a fixed release.
Rebuild and redeploy every program that embeds Wasmtime.
Rerun
cargo tree -i wasmtimeand confirm the new version.Pause outside-module compilation on anything still unpatched.
If you use Spin, version 4.2.4 moved to Wasmtime 50.0.0 on October 21.
What learners can take from this
This story shows why a sandbox is only as strong as the compiler behind it. A tiny integer overflow turned into a possible escape. It also shows that a library bug hides inside every program that bundles it, so you need an inventory of your dependencies. If you want to build these habits, the Cybersecurity certification paths cover vulnerability management and secure operations. For a similar patching story, read our note on the critical Brotli flaw in .NET.
When you are ready to book an exam, browse the vouchers listed on the Cybersecurity certification paths page.
Sources
Questions about this topic
Do I need to worry if I only run the wasmtime command-line tool?
Check its version against the table. If it is on an unfixed release, update it. If you also ship programs that embed Wasmtime as a library, those need a rebuild with a fixed version, because updating the CLI does not change them.
Can an attacker use these flaws against my host with no access to it?
They need a module they control to be compiled by a vulnerable Wasmtime build. If your host never compiles modules from outsiders, the exposure is much lower. Services that run other people's code face the most risk.
Why does the ARM64 flaw need a huge br_table?
The ARM64 branch Cranelift used can only reach about 1 MiB. A `br_table` with more than about 256,000 targets makes the jump table too large for that reach. The branch then lands in the wrong place.
What changed in the fixed versions for br_table?
Fixed versions send out-of-range indexes through the jump table itself, so no long branch is needed. They also refuse to compile a `br_table` with more than 65,520 targets.
Which Wasmtime release lines still get security fixes?
Only the 36, 48, 49 and 50 lines are supported. LTS releases are numbered in multiples of 12 and are supported for two years, while other releases get two months. The 24.x LTS line ended support on August 20, 2026 and got no fix.