- Wasmtime patched two critical sandbox escapes, both rated 9.9.
- One flaw affects only ARM64; no attacks reported.
- Updates: 36.0.19, 48.0.7, 49.0.4, and 50.0.0.
Two critical flaws in Wasmtime, a WebAssembly runtime that can be embedded in software, could let a malicious WebAssembly module escape its sandbox, the Bytecode Alliance warned on October 19. Both bugs are in Cranelift, its default compiler, and each scored 9.9 on the CVSS scale.
An attacker must first supply a module to a vulnerable build, and one flaw affects only ARM64 systems. Fixed versions arrived on October 19 and 20, with no reported attacks.
The sandbox is meant to keep a module inside set limits, restricting it to its own memory and allowed host functions. Consequently, the risk is highest for services that compile outside code, such as Fastly, which runs customer code on Wasmtime, according to its Compute documentation.
CVE-2026-115889 stems from Cranelift packing tracking numbers into 24-bit fields before version 43, letting an overflow generate incorrect machine code. A very large crafted function can force type confusion and escape the sandbox.
CVE-2026-115893 affects only ARM64 and involves the br_table instruction, where an out-of-range index can use a branch that reaches only about 1 MiB. With enough jump targets, the branch can point to the wrong place, and the advisory says a module “can be forced to jump to arbitrary code by a user-controlled Wasm module.”
Fixed releases include 36.0.19, 48.0.7, and 49.0.4; Wasmtime 50.0.0 is also fixed. Because Wasmtime is a library, each software package using it must be rebuilt, and hosts on unsupported lines must move to a supported release.
No workaround is available. Both flaws are listed in RustSec as RUSTSEC-2026-0380 and RUSTSEC-2026-0379, and neither was in CISA‘s Known Exploited Vulnerabilities catalog as of October 26.
GitHub‘s advisory database has a reviewed entry only for CVE-2026-115889, so Dependabot alerts may not cover the ARM64 flaw. Meanwhile, Spin, a serverless WebAssembly tool, moved to Wasmtime 50.0.0 in version 4.2.4 on October 21.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
