Wasmtime: Cranelift bit-packing overflow enables sandbox escape via crafted Wasm module (CVE-2026-115889)
Severity: critical · Patch status: patched · Since 2026-10-19 · CVE-2026-115889
Wasmtime's Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds, producing incorrect value references in the IR and arbitrary miscompilation. A very large or specially crafted Wasm function using many SSA values can force type confusion or other side effects and escape the sandbox. Any Wasmtime engine using default settings (Cranelift backend) on any architecture is affected, making this critical for anyone running untrusted Wasm modules. Fixed in Wasmtime v36.0.19 (backport) and v43.0.0, where Cranelift now uses a full u32 index with explicit limit checks. No public exploitation reported; EPSS 0.66%.
What to do
- Upgrade Wasmtime to v36.0.19 or v43.0.0 immediately if you run untrusted Wasm modules
- If upgrading is not immediately possible, restrict or sandbox which Wasm modules are executed and avoid running untrusted module bodies
- Audit dependencies and services that embed Wasmtime (e.g. Rust services, Fastly/Lucene-style runtimes) and rebuild against the patched version
- Monitor for suspicious Wasm module workloads or crashes that could indicate exploitation attempts
Fixed versions
Sources
All live incidents on Threat Watch
