Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 HIGH PRIORITY (CVSS 9.8-9.9) ├ CVE-2026-115889 · Wasmtime · Cranelift bit-packing causes silent overflow and miscompilation (9.9) ├ CVE-2026-115893 · Wasmtime · Cranelift on aarch64 can jump to the wrong target (9.9)
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-115889 (CVSS: 9.9) bytecodealli... CVE-2026-115893 (CVSS: 9.9) bytecodealli... CVE-2026-115931 (CVSS: 9.9) gitroomhq CVE-2026-53942 (CVSS: 9.9) conda CVE-2026-112846 (CVSS: 9.8) ThemeREX Group ..🧵👇