---
id: "CVE-2026-115893"
kind: "vulnerability"
aliases: ["CVE-2026-115893"]
title: "Wasmtime on aarch64: br_table bug lets Wasm modules escape the sandbox"
severity: "critical"
cvss: 9.9
epss: 0.00792
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["aarch64", "cranelift", "multi-tenant", "plugin-systems", "runtime", "wasmtime", "webassembly"]
not_affected_if: ["trusted-wasm-only", "x86_64-only"]
published_at: "2026-10-23T22:16:58+00:00"
first_seen_at: "2026-10-23T23:44:51+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115893", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115893", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Wasmtime on aarch64: br_table bug lets Wasm modules escape the sandbox

Wasmtime's Cranelift compiler on aarch64 can emit a wrong branch target for a br_table instruction with about 256,000 or more targets. A user-controlled WebAssembly module can use this to jump to arbitrary code and escape the sandbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `wasmtime --version` (or check the Wasmtime version pinned in your dependencies) and compare it with the fixed releases below
- Confirm whether the host runs on aarch64 and uses the default Cranelift backend; the sources do not give a more specific check

## Fix

- Upgrade Wasmtime to `36.0.19`, `48.0.7`, or `49.0.4` depending on your release line
- Until upgraded, avoid running untrusted or user-supplied Wasm modules on aarch64 hosts (inference from the sources, not stated there)

## Timeline

- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115893
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115893

## From the sources

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_