Cranelift Compiler Backend Vulnerability in Wasmtime Runtime
CVE-2026-115889
9.9CRITICAL
What is CVE-2026-115889?
The Cranelift compiler backend within the Wasmtime runtime has a vulnerability that arises from improper bit-packing of SSA value indices. This issue can occur in versions prior to 36.0.19 and 43.0.0, leading to silent overflows during the compilation of specially crafted WebAssembly functions. Such overflows allow for the potential misreference of intermediate representation (IR) values. This could enable arbitrary miscompilation or type confusion, allowing malicious actions that escape the Wasm sandbox on architectures that utilize the default Cranelift backend. Users are advised to upgrade to the patched versions to mitigate this vulnerability.
Affected Version(s)
wasmtime < 36.0.19 < 36.0.19
wasmtime >= 37.0.0, < 43.0.0 < 37.0.0, 43.0.0