CVE-2026-115889 - Exploits & Severity

In Wasmtime prior to v43, the Cranelift compiler backend bit-packs SSA value indices in a way that causes silent overflow in release builds, resulting in incorrect value references in the IR. A specially-crafted or very large Wasm function body can exploit this to force type-confusion or other arbitrary side-effects and escape the sandbox.

An attacker who can provide a specially-crafted Wasm module to a Wasmtime engine with default settings can achieve arbitrary code execution and escape the WebAssembly sandbox, potentially gaining full system access.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Yes, Wasmtime v36.0.19 and v43+ contain fixes for this issue.

Upgrade Wasmtime to version 36.0.19 or later (v43 or later recommended). If upgrade is not immediately possible, restrict the ability to load untrusted Wasm modules into Wasmtime engines.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-115889 . See article

GitHub Advisories released a security advisory .

A CVSS base score of 9.9 has been assigned.

NVD published the first details for CVE-2026-115889

Detection for the vulnerability has been added to Nessus ( 371633 )

Bulletin ID: GHSA-897f-g5gm-fmxm

CVE-2026-112866: WPFactory Product Filter Blind SQLi Enables Critical Data Exfiltration

Linux Distros Unpatched Vulnerability : CVE-2026-115889

CVE-2026-115889 - Exploits & Severity - Feedly

Wasmtime Cranelift backend suffers CRITICAL (CVSS 9.9) numeric truncation vuln (CVE-2026-115889) in =37.0.0 <43.0.0. Risk: sandbox escape & code exec. Upgrade to 36.0.19 or 43.0.0+ now. #OffSeq #CVE2026115889 #WebAssembly #Security

CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation [CRITICAL] CVSS 9.9

Be the first to know critical vulnerabilities

Collect, analyze, and vulnerability reports faster using AI