Maintainers of Wasmtime, a widely utilized WebAssembly runtime designed for seamless integration into other software systems, have issued urgent security advisories disclosing two severe vulnerabilities. These critical security flaws could potentially empower a malicious WebAssembly module to shatter the strict security boundaries of the runtime sandbox designed to contain it.
The discovery highlights growing security challenges surrounding the execution of untrusted code outside traditional web browsers. According to technical advisories published by the Bytecode Alliance, the organization overseeing Wasmtime’s development, both vulnerabilities reside within Cranelift, the default compiler engine responsible for translating WebAssembly bytecode directly into native machine code. Project maintainers assigned a severe CVSS severity score of 9.9 out of a possible 10 to each of the flaws, underlining the magnitude of the risk for affected environments.
To successfully exploit either vulnerability, an attacker must first possess the capability to supply a specially crafted WebAssembly module to a vulnerable build of Wasmtime, which the engine then compiles. Furthermore, one of the two identified security issues is strictly confined to ARM64 hardware architectures. Swiftly responding to the discoveries, the project maintainers rolled out patches and fixed versions across supported release lines on October 19 and 20. At the time of the advisories, no active exploitation in the wild had been reported, and the vulnerabilities had not been incorporated into the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency as of late October.
The core purpose of the Wasmtime sandbox is to enforce absolute containment, ensuring that any running WebAssembly module operates strictly within predetermined, rigid boundaries. Under normal operating conditions, a module is restricted to its own designated memory space and specifically authorized host functions, while its internal execution flow is constrained to pre-checked, valid jump destinations.
Because successful exploitation hinges entirely on the deployment of an attacker-controlled module, the threat level increases significantly for multi-tenant services, cloud infrastructure providers, and serverless platforms that dynamically compile and execute code submitted by third-party users or external developers. For instance, commercial edge computing platforms like Fastly’s Compute service rely heavily on Wasmtime to execute arbitrary customer code safely. While the official advisories did not explicitly name individual third-party services or detail the exact scope of accessible data following a theoretical sandbox escape, the potential implications for shared hosting environments prompted immediate remediation efforts across the software ecosystem.
Which Versions Are Affected
Because the two distinct vulnerabilities were addressed at varying times across the project’s lifecycle, whether a specific deployment remains vulnerable depends heavily on the active release line and, in the case of the ARM64-specific bug, the underlying processor architecture.
The first issue, tracked as CVE-2026-115889, affects any underlying processor architecture and impacts multiple legacy and standard release lines. Versions prior to 36.0.19, including the 24.x long-term support line, are vulnerable. Similarly, versions ranging from 37.0.0 through 42.x are affected. However, versions 43.0.0 through 47.x, along with versions 48.0.0 through 48.0.6 and 49.0.0 through 49.0.3, remain unaffected by this specific architecture-independent flaw. The vulnerability was permanently resolved in version 36.0.19, version 48.0.7, version 49.0.4, and version 50.0.0.
The second vulnerability, cataloged as CVE-2026-115893, is exclusively restricted to ARM64 systems and has a notably wider historical footprint. It impacts versions prior to 36.0.19, version ranges 37.0.0 through 42.x, 43.0.0 through 47.x, 48.0.0 through 48.0.6, and 49.0.0 through 49.0.3. This means that ARM64 hosts that previously applied patches earlier in the year to resolve an unrelated, prior Cranelift sandbox escape on ARM64 remain vulnerable to this newly disclosed issue. Remediation requires updating to version 36.0.19, 48.0.7, 49.0.4, or 50.0.0.
Wasmtime follows a structured support model, maintaining long-term support release lines—identified by version numbers that are multiples of 12—for a duration of two years. Standard release lines receive security support for two months. Crucially, security patches are strictly guaranteed only for supported release lines. Among the affected branches, only the 36, 48, 49, and 50 release lines remain actively supported by the maintainers. Unsupported lines, including the 24.x LTS branch which officially reached its end-of-life on August 20, 2026, received no official backported fix, requiring users to migrate entirely to a newer, supported release line.
What to Do
Administrators and developers running affected configurations are advised to update their deployments immediately to the designated fixed releases for their respective lines. Recommended targets include version 36.0.19, version 48.0.7, or version 49.0.4, while version 50.0.0 includes comprehensive fixes for both security flaws. Environments currently operating on unsupported release lines must transition directly to one of these actively maintained and patched versions.
Because Wasmtime is frequently embedded directly as an internal library within larger software applications rather than being deployed merely as a standalone command-line tool, simply updating local binaries or runtimes is insufficient. Every individual software program that incorporates Wasmtime as a dependency must be completely rebuilt and recompiled using a secure, patched version of the library.
Official advisories did not provide temporary workarounds or mitigation configurations. Until affected host applications are successfully updated, the primary vector of risk stems entirely from untrusted WebAssembly modules supplied by external or untrusted parties.
The security community has actively cataloged the vulnerabilities across developer databases. Both flaws are officially listed in RustSec—the advisory database utilized by the cargo-audit security tool to verify Rust dependency lock files—under identifiers RUSTSEC-2026-0380 and RUSTSEC-2026-0379. GitHub’s advisory database published a reviewed entry for CVE-2026-115889, while the entry for the ARM64-specific flaw required additional processing. Because automated platform alerts like Dependabot rely exclusively on fully reviewed database entries, users monitoring their software supply chains through automated alerts were advised to verify their dependency versions manually regarding the ARM64 bug. Downstream open-source projects relying on the runtime have moved quickly to integrate the patches; for instance, Spin, an open-source framework designed for building serverless WebAssembly applications atop Wasmtime, upgraded its underlying dependencies to Wasmtime 50.0.0 with the release of version 4.2.4.
How the Two Flaws Work
A deep dive into the technical mechanics of the vulnerabilities reveals how subtle compiler implementation details can compromise memory safety. The first flaw, CVE-2026-115889, originates from the internal mechanism Cranelift utilized to store numerical identifiers used for tracking discrete values within a function. In compiler iterations prior to version 43, these internal tracking numbers were constrained within compact 24-bit fields. In standard release builds, if a function generated a number exceeding the capacity of its assigned field, the value would silently overflow without triggering an error or exception.
Consequently, Cranelift could inadvertently reference an incorrect internal value, leading to the generation of flawed or corrupted machine code. According to project advisories, an unusually large WebAssembly function, or one deliberately structured to consume a high volume of internal values, could exploit this behavior to induce type confusion, ultimately bypassing sandbox boundaries and achieving arbitrary code execution.
Interestingly, Wasmtime’s primary development branch had inadvertently eliminated this underlying defect months prior. A code change merged into the repository widened these internal tracking fields to 32 bits and was officially rolled out in Wasmtime 43.0.0. At the time of its initial deployment, the change was documented strictly as a performance and capability enhancement designed to facilitate the compilation of larger functions, with its underlying security implications recognized much later.
The second vulnerability, CVE-2026-115893, centers around the handling of br_table, a standard WebAssembly instruction that executes a jump to one of many potential target locations within code based on a dynamic numerical index. If a provided index falls outside the defined bounds of the table, execution is safely routed to a designated default target. On ARM64 architectures, however, Cranelift handled out-of-range indexes by routing them toward the default location using a branch instruction constrained by hardware limitations to a reach of approximately one megabyte.
When a br_table instruction was constructed with more than roughly 256,000 individual targets, the resulting jump table grew too massive for that conditional branch to span. As a result, the branch silently miscalculated and pointed to an unintended memory address. The advisory warns that any Wasmtime execution engine running on ARM64 hardware with standard default configurations could theoretically be forced to jump directly to arbitrary code execution through a carefully constructed WebAssembly module. This particular structural bug had persisted within the codebase since Wasmtime first established support for ARM64 architectures in 2020.
The definitive code fix resolves the issue by routing out-of-range indexes directly through the jump table mechanism itself, eliminating the dependency on long-distance conditional branches. Additionally, newly patched versions enforce strict safety limits, refusing to compile any br_table instruction containing more than 65,520 targets.
