{"id":"CVE-2026-115889","published":"2026-10-23T22:16:58.400","lastModified":"2026-10-26T18:17:38.213","description":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-197","CWE-843"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/12613","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm","tags":[]}],"exploitRefs":[{"url":"https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/12613","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm","tags":[]}],"hasPoc":true,"ai":{"summary":"A silent integer overflow in Cranelift's SSA value indexing can cause miscompilation of large or crafted WebAssembly functions, breaking the Wasm sandbox and enabling arbitrary code execution outside the sandbox.","exploitability":"Exploitation requires a privileged attacker (PR:L) to submit a specially crafted Wasm module with enough SSA values to trigger the overflow; network exposure alone is insufficient.","blast_radius":"Successful exploitation allows full compromise of the host running Wasmtime, including data exfiltration, system modification, and potential lateral movement from compromised WebAssembly workloads.","remediation":"Upgrade to Wasmtime version 36.0.19 or 43.0.0 (or later) to patch the integer overflow in the Cranelift backend.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["wasm-sandbox-bypass","integer-overflow","miscompilation","sandbox-escape"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:52:39.149Z"}}