CVE-2026-115893 in Wasmtime
Summary
by MITRE • 10/24/2026
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified within Wasmtime affects the Cranelift compiler backend specifically when operating on aarch64 architectures. Prior to the release of versions 36.0.19, 48.0.7, and 49.0.4, the runtime contained a critical logic error in how it handled WebAssembly br_table instructions that exceeded approximately 256,000 targets. The Cranelift backend is responsible for translating high-level WebAssembly bytecode into native machine code optimized for the host processor architecture. In this specific scenario involving large branch tables on ARM64 systems, the compiler failed to correctly calculate or validate the conditional branch target address during the compilation process. This flaw resulted in the generation of incorrect assembly instructions that did not adhere to the intended control flow defined by the WebAssembly module author but instead pointed to arbitrary memory locations determined by user input within the malicious module.
This technical defect constitutes a severe sandbox escape vulnerability, allowing untrusted WebAssembly modules to break out of their isolated execution environment and execute code with higher privileges or access sensitive host system resources. The core issue stems from an improper handling of large jump tables where the offset calculation logic does not properly account for boundary conditions or integer limits inherent in the target architecture's instruction encoding. When a Wasm module contains a br_table with more than roughly 256,000 entries, the compiler backend miscalculates the destination address, leading to an arbitrary code execution vector within the host process context. This aligns closely with CWE-787 Out-of-bounds Write and CWE-190 Integer Overflow or Wraparound concepts, as the error arises from incorrect arithmetic operations during compilation that lead to memory safety violations at runtime.
From a threat intelligence perspective, this vulnerability enables attackers to bypass security boundaries established by WebAssembly sandboxes, which are designed to prevent malicious code from accessing host files, network interfaces, or other processes. The ability to jump to arbitrary user-controlled offsets effectively neutralizes the isolation guarantees provided by Wasmtime on affected systems. This behavior is consistent with ATT&CK technique T1059 Command and Scripting Interpreter if interpreted as a means to execute further payloads, but more accurately reflects privilege escalation via sandbox escape mechanisms often categorized under lateral movement or initial access exploitation depending on the deployment context. The impact extends beyond simple data exfiltration; it allows for full compromise of the host environment running Wasmtime instances that utilize the default Cranelift backend without additional hardening measures like WebAssembly System Interface restrictions or seccomp filters.
Mitigation requires immediate upgrading to patched versions of Wasmtime, specifically version 36.0.19, 48.0.7, or 49.0.4 and later releases where the Cranelift backend logic has been corrected to properly handle large branch tables on aarch64 platforms. Organizations deploying WebAssembly workloads should verify their runtime versions across all infrastructure nodes utilizing ARM-based processors. Additionally, implementing defense-in-depth strategies such as restricting system calls available to Wasmtime processes via seccomp profiles and running these services with minimal privileges can reduce the blast radius in case of future vulnerabilities. Continuous monitoring for anomalous memory access patterns or unexpected process behavior within containers hosting WebAssembly workloads is also recommended to detect potential exploitation attempts before full compromise occurs.