{"id":"CVE-2026-115893","published":"2026-10-23T22:16:58.820","lastModified":"2026-10-23T22:16:58.947","description":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-691"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14826","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","tags":[]}],"exploitRefs":[{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14826","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","tags":[]},{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","tags":[]}],"hasPoc":true,"ai":{"summary":"A flaw in Cranelift's aarch64 backend allows a malicious WebAssembly module to craft a br_table with over ~256,000 targets, causing an incorrect conditional branch that jumps to arbitrary code at a user-controlled offset, breaking out of Wasmtime's sandbox.","exploitability":"Exploitation requires the attacker to control a Wasm module and deploy it on a vulnerable Wasmtime instance running on aarch64 with the default Cranelift backend; no user interaction or high privileges beyond low-privilege Wasm execution are needed.","blast_radius":"Successful exploitation allows full compromise of the host process — arbitrary code execution, data theft, and potential lateral movement — effectively turning a sandbox escape into full system compromise on affected platforms.","remediation":"Upgrade to Wasmtime version 36.0.19, 48.0.7, or 49.0.4 (or later) to patch the Cranelift aarch64 br_table miscompilation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sandbox-escape","rce","wasm","aarch64","compiler-bug"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:52:57.390Z"}}