CriticalCVE
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
The Hacker News·Source published ·1 min read
What happened?
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems.
Key details
- Two critical Wasmtime flaws allow malicious WebAssembly modules to escape their sandbox.
- Both vulnerabilities reside in Cranelift, the default compiler Wasmtime uses to translate WebAssembly to machine code.
- CVE-2026-115889 affects all processor architectures while CVE-2026-115893 is limited to ARM64 systems.
- Services that compile untrusted modules face the highest risk because both flaws require an attacker-controlled module.
- Fixed versions were released on October 19 and 20 with no reported attacks as of October 26.
- Updating the Wasmtime command-line tool alone does not fix embedded uses; each program must be rebuilt with a fixed version.
- CVE-2026-115889 stems from 24-bit value tracking fields overflowing in release builds before version 43.
Affected
- Wasmtime versions before 36.0.19 including 24.x LTS are affected by both flaws.
- Wasmtime 43.0.0 through 47.x are affected only by the ARM64 flaw CVE-2026-115893.
- Wasmtime 48.0.0 through 48.0.6 are affected only by the ARM64 flaw CVE-2026-115893.
- Wasmtime 49.0.0 through 49.0.3 are affected only by the ARM64 flaw CVE-2026-115893.
- ARM64 hosts previously updated to 36.0.7, 42.0.2, or 43.0.1 remain affected by CVE-2026-115893.
Fixes and mitigations
- Fixed versions also refuse to compile br_table instructions with more than 65,520 targets.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.