CriticalCVE
Wasmtime Sandbox Escape Flaws Patched in Cranelift
SOCRadar·Source published ·1 min read
What happened?
Two critical Wasmtime sandbox escape flaws, CVE-2026-115889 and CVE-2026-115893, let a crafted WebAssembly (Wasm) module push the Cranelift compiler into generating unsafe machine code. The Bytecode Alliance fixed both on October 19, 2026, and rated each 9.9 under CVSS v3.1. Platforms that compile Wasm from customers or other outside parties carry the most risk, because they depend on Wasmtime to keep that code contained. One flaw affects every architecture, while the other hits ARM64 (aarch64) hosts running default settings.