Live › vulnerability › CVE-2026-115893
Go to dashboardWasmtime's Cranelift compiler on aarch64 can emit a wrong branch target for a br_table instruction with about 256,000 or more targets. A user-controlled WebAssembly module can use this to jump to arbitrary code and escape the sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 23:44 UTC. All times on this page are UTC.
Teams that embed Wasmtime on aarch64 and run WebAssembly modules that they do not fully trust, such as plugin systems, serverless or multi-tenant platforms. The flaw needs a Wasm module with a very large br_table, which a user-supplied module could contain. Teams running Wasmtime only on x86_64 or only on their own trusted Wasm code are less exposed; the sources do not say more.
No product ranges from the sources yet.
wasmtime --version (or check the Wasmtime version pinned in your dependencies) and compare it with the fixed releases below36.0.19, 48.0.7, or 49.0.4 depending on your release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-115893")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.