CVE-2026-115893Critical· 9.9▾ AbyssalPoC availableWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect condi…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 54.5 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.8%
1 GitHub repo
0.8% → 1.0%
Last analysed / modified upstream
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
wasmtime < 36.0.19wasmtime >= 37.0.0, < 48.0.7wasmtime >= 49.0.0, < 49.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wasmtime < 36.0.19wasmtime >= 37.0.0, < 48.0.7wasmtime >= 49.0.0, < 49.0.4Patched in:
wasmtime 36.0.19wasmtime 48.0.7wasmtime 49.0.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115892Medium· 5.7Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115889Critical· 9.9Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
RUSTSEC-2026-0379Critical· 9.9Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
CVE-2026-104855Low· 2.0Wasmtime is a runtime for WebAssembly
CVE-2023-41880Low· 2.2Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
CVE-2021-39216Medium· 6.3Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime