Arbitrary Code Execution Vulnerability in Wasmtime Runtime for WebAssembly
CVE-2026-115893
9.9CRITICAL
What is CVE-2026-115893?
A vulnerability in the Wasmtime WebAssembly runtime allows a user-controlled Wasm module to potentially escape its sandbox. A flaw in the Cranelift compiler backend for aarch64 can cause a 'br_table' instruction to compile incorrectly, leading to improper branch target assignments. This misconfiguration can allow execution to redirect to arbitrary code at user-defined offsets, thereby circumventing security measures. This issue has been addressed in subsequent versions of Wasmtime, which are crucial for maintaining secure execution environments.
Affected Version(s)
wasmtime < 36.0.19 < 36.0.19
wasmtime >= 37.0.0, < 48.0.7 < 37.0.0, 48.0.7
wasmtime >= 49.0.0, < 49.0.4 < 49.0.0, 49.0.4