VulnSocial

CVE-2026-115889

LOWCVSS 9.9 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-197CWE-843

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse4 posts
  • Upwind Security MDR@UpwindMDR

    🚨Critical - Wasmtime Cranelift SSA Index Bit-Pack Overflow Miscompile (CVE-2026-115889) Wasmtime’s default Cranelift backend bit-packs SSA value indices and can silently overflow in release builds when compiling very large/specially crafted Wasm functions, causing wrong IR value references -> arbitrary miscompilation and type confusion, potentially enabling Wasm sandbox escape. Debug builds are typically not affected due to overflow checks. 👉Affected: wasmtime < 36.0.19 and >= 36.0.19 < 43.0.0 | Upgrade to 36.0.19 or 43.0.0

    0000062
    360 followersView on X
  • DailyCVE@dailycve

    🔴 Wasmtime, Bit-packing in Cranelift compiler causes silent overflow and miscompilation, #CVE-2026-115889 (Critical) - Just Updated -DC-Oct2026-3736 https://dailycve.com/wasmtime-bit-packing-in-cranelift-compiler-causes-silent-overflow-and-miscompilation-cve-2026-115889-critical-just-updated-dc-oct2026-3736/

    0000028
    245 followersView on X
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-115889 (CVSS 9.9 Critical) Cranelift SSA bit-packing overflow in Wasmtime causes type confusion in release builds, allowing crafted Wasm modules to escape the host sandbox. ⚡ Action: Update Wasmtime to v36.0.19 / v43.0.0. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115889/ https://t.co/sGGeowXfMt

    0000033
    195 followersView on X
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-115889 (CVSS 9.9 Critical) Cranelift SSA bit-packing overflow in Wasmtime causes type confusion in release builds, allowing crafted Wasm modules to escape the host sandbox. ⚡ Action: Update Wasmtime to v36.0.19 / v43.0.0. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-115889/ https://t.co/GsrViFiPxs

    0000026
    195 followersView on X

Explore more

Back to dashboard