{"id":"CVE-2026-115893","title":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","summary":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect condi…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-691"],"vendor":"bytecodealliance","product":"wasmtime","affected":["wasmtime < 36.0.19","wasmtime >= 37.0.0, < 48.0.7","wasmtime >= 49.0.0, < 49.0.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-29T18:19:46.559873Z"},"exploitAvailable":true,"published":"2026-10-23","updated":"2026-10-29","sourceUpdated":"2026-10-29T18:20:01.899Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115893","references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","label":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","label":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","label":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","label":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14826","label":"https://github.com/bytecodealliance/wasmtime/pull/14826"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","label":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","label":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","label":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","label":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0379.html"},{"url":"https://github.com/advisories/GHSA-mghf-wjfp-p5xm"},{"url":"https://github.com/bytecodealliance/wasmtime"},{"url":"https://crates.io/crates/wasmtime"}],"tags":["cve.org","ghsa","rust","exploit-available","osv"],"aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"ecosystem":"rust","patched":["wasmtime 36.0.19","wasmtime 48.0.7","wasmtime 49.0.4"],"epss":0.0099,"epssPercentile":0.62523,"exploits":{"github":1,"githubRepos":["https://github.com/shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escape"],"checkedAt":"2026-11-01T17:58:21.188Z"},"ingestedAt":"2026-10-23T21:38:13.047Z","slug":"CVE-2026-115893","body":"## Overview\n\nWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.\n\n## Affected\n\n- `wasmtime < 36.0.19`\n- `wasmtime >= 37.0.0, < 48.0.7`\n- `wasmtime >= 49.0.0, < 49.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-115893)\n\nAffected packages:\n\n- `wasmtime < 36.0.19`\n- `wasmtime >= 37.0.0, < 48.0.7`\n- `wasmtime >= 49.0.0, < 49.0.4`\n\nPatched in:\n\n- `wasmtime 36.0.19`\n- `wasmtime 48.0.7`\n- `wasmtime 49.0.4`\n\nSource: https://github.com/advisories/GHSA-mghf-wjfp-p5xm","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":54.5,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":229932,"id":"CVE-2026-115893","ts":1793120341387,"field":"exploit_available","old":"false","new":"true"}]}