Paper/Archive/CVE-2026-115893

CVE-2026-115893

bytecodealliance wasmtime — Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

EPSS 1.0%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 62.4.624 × 2012.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Affected

ProductAffectedFixed inSource

wasmtime< 36.0.19–CNA

wasmtime>= 37.0.0, < 48.0.7–CNA

wasmtime>= 49.0.0, < 49.0.4–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References