Bytecode Alliance Wasmtime up to 36.0.18/42.x Cranelift compiler backend indices type confusion

Summaryinfo

A vulnerability categorized as critical has been discovered in Bytecode Alliance Wasmtime up to 36.0.18/42.x. Affected by this issue is some unknown functionality of the component Cranelift compiler backend. The manipulation of the argument indices results in type confusion. This vulnerability is reported as CVE-2026-115889. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Bytecode Alliance Wasmtime up to 36.0.18/42.x. Affected is an unknown functionality of the component Cranelift compiler backend. The manipulation of the argument indices with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-115889 since 10/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit.

Upgrading to version 36.0.19 or 43.0.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-109186). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bytecode Alliance

Name

• Wasmtime

Version

• 36.0.0
• 36.0.1
• 36.0.2
• 36.0.3
• 36.0.4
• 36.0.5
• 36.0.6
• 36.0.7
• 36.0.8
• 36.0.9
• 36.0.10
• 36.0.11
• 36.0.12
• 36.0.13
• 36.0.14
• 36.0.15
• 36.0.16
• 36.0.17
• 36.0.18
• 42.x

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion