CVE-2026-115889

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

No known exploitation. EPSS puts it in the 39th percentile. No fix published yet.

CVSS 3.19.9Critical EPSS percentile39th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Check it yourself

No ready-made check. Neither Nuclei nor OpenVAS has one for this CVE yet.

Request a scan

Published 2026-10-23Updated 2026-10-26Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Bytecodealliance WasmtimeAffected: < 36.0.19Upgrade to: not statedAffected: >= 37.0.0, < 43.0.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your developer or vendor if any product you run embeds Wasmtime or the Cranelift compiler.
If so, ask them to confirm whether the version in use is affected and what the vendor-recommended fixed version is.
If you cannot get confirmation of a fix, consider disabling execution of untrusted WebAssembly code until a patched version is confirmed available.
Re-check with your vendor periodically, since a confirmed fixed version was not available at the time of this review.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

In plain language

Written by AI from the record

This is a flaw in Wasmtime, a tool used to run WebAssembly programs safely, that could let a malicious program break out of its safety sandbox — most small businesses don't use this directly, but if your software runs on it, it's worth checking.

Integer overflow in Cranelift's SSA value-index bit-packing (CWE-197/CWE-843) can cause Wasmtime to reference incorrect IR values during compilation of crafted Wasm functions, leading to miscompilation, type confusion, and potential sandbox escape with attacker-controlled effects.

If you're affected

Sandbox escape risk
Arbitrary code execution
Service compromise
Operational disruption

What is it

Wasmtime is like a secure sandbox that lets small, untrusted programs run safely without touching the rest of the computer. This bug is like a flaw in the sandbox's walls — under the right crafted conditions, a program running inside could potentially break through and interfere with the system around it.

Who is affected

This matters to you only if a product, platform, or service you use embeds Wasmtime to run WebAssembly code — most small businesses don't build this directly, but some software vendors and cloud/edge platforms do. If you don't know whether your software relies on WebAssembly execution, ask your vendor directly; otherwise this is unlikely to apply to you.

How urgent is it

There is no evidence yet that attackers are exploiting this flaw, and no public exploit code exists, so this is not an emergency fire-drill. Still, the potential severity (a full sandbox escape) means it deserves prompt attention from anyone running affected software, rather than being ignored.

What to do — in detail

Inventory any services, edge/cloud platforms, or applications that embed Wasmtime or Cranelift for executing WebAssembly modules. 2. Determine the exact Wasmtime version in use and check with the vendor/maintainer for confirmation of a fixed release, since no fix/patch information was available at review time. 3. If untrusted or externally-supplied Wasm modules are compiled and run, treat this as higher priority — the flaw triggers on compiling 'sufficiently large or specially crafted' Wasm functions with many SSA values. 4. As a temporary mitigation, restrict or disable execution of untrusted/third-party WebAssembly modules on affected systems until a fix is confirmed. 5. Monitor the Wasmtime project's advisories for the official patched release and apply it as soon as it is published. 6. No CISA KEV listing exists for this CVE, so there is no regulatory remediation deadline at this time.

Technical context

CVSS 9.9 (Critical), AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network-exploitable sandbox escape potential with low complexity. Weakness types: CWE-197 (numeric truncation) and CWE-843 (type confusion). Not in CISA's Known Exploited Vulnerabilities catalog; no public exploit code recorded. Predicted exploitation likelihood is low with a flat trend, consistent with the absence of observed exploitation. No patch/fix information was confirmed available in the findings reviewed; organizations should track vendor advisories directly for a fixed release.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 3 days, from the signal feeds we watch.

2026-10-26Record updated
2026-10-23Publishedweakness classified, att&ck mapped, record updated

Affected products

bytecodeallianceoss-project
- wasmtimeLibraryLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable