The maintainers of Wasmtime, a widely used standalone WebAssembly (Wasm) runtime developed under the Bytecode Alliance, have disclosed two critical security flaws. Tracked with a severe 9.9 out of 10 CVSS score, these vulnerabilities could allow a crafted, malicious WebAssembly module to break out of its designated sandbox and compromise the host environment.

Both bugs reside in Cranelift, the default compiler engine used by Wasmtime to translate WebAssembly code directly into machine code.

Understanding the Flaws

CVE-2026-115889 (All Architectures): This bug affects Wasmtime across all processor architectures. It stems from how Cranelift historically stored internal tracking values using compressed 24-bit fields. Under specific scenarios—such as dealing with unusually large or complex WebAssembly modules—these fields would silently overflow without throwing errors, causing type confusion and allowing code to escape runtime boundaries.(Note: The main development branch addressed this by upgrading fields to 32 bits back in early 2026, but older stable and long-term support lines remained vulnerable until recent backports.)

CVE-2026-115893 (ARM64 / aarch64 Only): This architecture-specific vulnerability impacts systems running on ARM64 processors. It originates from the handling of the WebAssembly br_table instruction, which manages multi-way jumps based on an index. For massive jump tables exceeding roughly 256,000 targets, the branch instruction used a limited reach (approx. 1 MiB) that silently targeted incorrect code locations, allowing a malicious module to force jumps to arbitrary memory addresses. This bug had been present since ARM64 support was first introduced to Wasmtime in 2020.

Who is at Risk?

Because exploiting these vulnerabilities requires an attacker to compile and execute a controlled WebAssembly module, the threat level is highest for cloud services, platforms, and serverless environments that dynamically compile or run untrusted user-submitted code (such as Fastly's Compute platform or similar edge-computing infrastructure).

Fortunately, project maintainers note that no active exploitation attempts have been observed in the wild, and the flaws are not currently listed under CISA’s Known Exploited Vulnerabilities catalog.

Affected Versions & Patch Status

Because Wasmtime is frequently embedded as a library inside other software packages rather than just run as a standalone binary, organizations must ensure that any software relying on Wasmtime is rebuilt and updated. Only supported release lines (specifically lines 36, 48, 49, and 50) have received official patches. Unsupported or older branches (including the 24.x LTS line) will not receive fixes.

• Wasmtime 50.0.0 (released October 20, 2026) is fully patched against both vulnerabilities.

• Line 36 LTS users should update to version 36.0.19.

• Line 48 users should update to version 48.0.7.

• Line 49 users should update to version 49.0.4.

Users running older, unsupported versions are strongly urged to migrate immediately to one of these active release channels.