Wasmtime vulnerability patch versions — 36.0.19, 48.0.7, 49.0.4; both 9.9 sandbox escapes came from the compiler
The Bytecode Alliance, which maintains the Wasmtime WebAssembly runtime, disclosed two CVSS 9.9 flaws in its Cranelift compiler on October 19, 2026. A crafted WebAssembly module could escape the sandbox and run arbitrary code. CVE-2026-115889 affects all CPU architectures and CVE-2026-115893 affects ARM64. Patched versions are 36.0.19, 48.0.7 and 49.0.4, and no attacks have been reported
The three lines
- Flaws — two CVSS 9.9 Cranelift bugs; a crafted Wasm module can escape the sandbox
- Fix — 36.0.19, 48.0.7 or 49.0.4 resolves all 29 October advisories
- Exposure — servers and plugin hosts running other people's Wasm first; no attacks reported
Key questions
- wasmtime patched versions
- **36.0.19, 48.0.7 and 49.0.4.** | Your line | Upgrade to | |---|---| | 36.x (long-term support) | 36.0.19 | | 37–48.x | 48.0.7 | | 49.x | 49.0.4 |
- CVE-2026-115889
- **A Cranelift bit-packing overflow that silently miscompiles code.** | Item | Detail | |---|---| | Score | CVSS 9.9 (critical) | | Architectures | All | | Affected | Below 36.0.19; 37.0.0 to below 43.0.0 | | Fixed | 36.0.19 (43.0.0+ not affected) | | Advisory | GHSA-897f-g5gm-fmxm |
- CVE-2026-115893
- **On ARM64, huge br_table instructions jump to the wrong target.** | Item | Detail | |---|---| | Score | CVSS 9.9 (critical) | | Architecture | ARM64 (aarch64) only | | Trigger | ~256,000+ branch targets | | Fixed | 36.0.19, 48.0.7, 49.0.4 | | Advisory | GHSA-mghf-wjfp-p5xm |
This hole wasn't in the walls of the box — it was in the machine that builds them. On October 19, 2026, the Bytecode Alliance, which maintains the Wasmtime WebAssembly runtime, published two CVSS 9.9 advisories. Both are in Cranelift, the compiler that turns Wasm into machine code. Feed it a crafted module and it can emit wrong code, letting the module touch memory outside its sandbox or jump to code of its choosing.
The short version: upgrade to 36.0.19, 48.0.7 or 49.0.4, whichever matches your release line, and all 29 Wasmtime advisories issued in October — including these two — are fixed. No attacks have been reported.
1. Am I affected?
| Version in use | CVE-2026-115889 (all CPUs) | CVE-2026-115893 (ARM64) | Upgrade to |
|---|---|---|---|
| 36.0.18 or earlier | Affected | Affected | 36.0.19 |
| 37.0.0 – 42.x | Affected | Affected | 48.0.7 |
| 43.0.0 – 48.0.6 | Not affected | Affected | 48.0.7 |
| 49.0.0 – 49.0.3 | Not affected | Affected | 49.0.4 |
| 36.0.19 / 48.0.7 / 49.0.4 | Fixed | Fixed | — |
On x86 servers running 43 or later, the ARM64 bug doesn't apply. But four lower-severity advisories landed the same day, plus the October 14 and October 2 batches, so moving to the latest patch is simplest. On ARM64 hardware such as AWS Graviton or Apple silicon, CVE-2026-115893 applies directly.
2. How the two bugs work
| Item | CVE-2026-115889 | CVE-2026-115893 |
|---|---|---|
| Advisory | GHSA-897f-g5gm-fmxm | GHSA-mghf-wjfp-p5xm |
| Location | Cranelift, shared | Cranelift ARM64 backend |
| Cause | Internal value indices bit-packed into a field silently overflow in release builds | A br_table with ~256,000+ targets compiles to a wrong conditional branch |
| Result | Miscompilation → type confusion → possible sandbox escape | Jump to an attacker-chosen offset → arbitrary code |
| Trigger | Get a huge or specially crafted Wasm function compiled | Get a module with a giant br_table compiled |
| CVSS | 9.9 | 9.9 |
Wasm's safety has two layers. The language rules keep a module inside its own memory, and the runtime emits machine code that enforces those rules. Both bugs sit in the second layer — translation. The source obeyed the rules; the generated machine code didn't.
The score is 9.9 rather than 10 because an attacker needs the ability to submit a module (low privileges required).
3. Who should hurry
| Environment | Risk | Why |
|---|---|---|
| Servers running Wasm uploaded by users or customers (plugins, edge functions, serverless) | High | Attackers can supply the module |
| Sandboxes running AI-generated code in Wasm | High | Model-written code isn't trusted |
| Running only your own Wasm | Low | Little path for a malicious module |
| Wasm in web pages | Not applicable | Chrome, Safari and Firefox don't use Wasmtime |
Wasmtime is used as a box for running other people's code safely, so risk depends on who can put a module in the box. If patching must wait, The Hacker Wire suggests isolating services that compile untrusted Wasm and capping their CPU and memory. Upgrading is the real fix.
4. Twenty-nine advisories in October, in three batches
| Date | Advisories | Highest severity | Fixed in |
|---|---|---|---|
| Oct 2 | 8 | 1 critical (async callback stack buffer overflow) | 36.0.17, 48.0.4, 49.0.2 |
| Oct 14 | 15 | 1 high (filesystem sandbox escape when renaming symlinks) | 36.0.18, 48.0.6, 49.0.3 |
| Oct 19 | 6 | 2 critical (these Cranelift bugs) | 36.0.19, 48.0.7, 49.0.4 |
The October 14 filesystem escape is a separate issue: it let code reach files outside the folders WASI had granted. The same month brought remote-code-execution fixes for Node.js and PHP as well — runtime patch cycles are speeding up across the board.
5. What remains and what is unconfirmed
- Exploitation: none reported; not in CISA's KEV catalog as of October 26.
- 24.x: absent from October's fixed-version lists; check its support status.
- CVE numbering: some databases list a different CVE and fixed versions for the October 14 filesystem escape; treat GitHub's advisory as authoritative.
- WebAssembly itself: why Wasm became the sandbox of choice for servers and plugins is covered in our companion explainer.
Sources
- GitHub Bytecode Alliance Wasmtime — GHSA-897f-g5gm-fmxm (CVE-2026-115889) advisory (2026-10-19)
- GitHub Bytecode Alliance Wasmtime — GHSA-mghf-wjfp-p5xm (CVE-2026-115893) advisory (2026-10-19)
- The Hacker News — Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes (2026-10-26)
- The Hacker Wire — CVE-2026-115889: Wasmtime is a runtime for WebAssembly
- Strix — CVE-2026-115893