CVE-2026-115889 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments, especially those using the Cranelift backend, should assess exposure and apply patches. This includes operators, platform administrators, vulnerability management teams, and security teams who need to prioritize assessing exposure and applying patches for Wasmtime versions prior to v43.

Why it matters

A vulnerability in the Cranelift compiler backend of Wasmtime can lead to silent overflow and miscompilation, potentially allowing a sandbox escape. Defenders should prioritize assessing exposure and applying patches for Wasmtime versions prior to v43.

• Potential sandbox escape from specially-crafted Wasm modules
• Miscompilation and incorrect value references in the IR
• Silent overflow in release builds
• Verification priority for Wasmtime versions prior to v43

Technical summary

The Cranelift compiler backend in Wasmtime prior to v43 has a vulnerability that can lead to silent overflow and miscompilation. A specially crafted Wasm module can exploit this to escape the sandbox. The issue is fixed in Wasmtime v36.0.19 and v43. This vulnerability affects Wasmtime deployments using the Cranelift backend, and defenders should assess exposure and apply patches accordingly. The vulnerability is caused by bit-packing in the Cranelift compiler backend, which can result in silent overflow and incorrect value references in the IR.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Wasmtime versions prior to v43, especially in environments using the Cranelift backend.

Recommended defensive actions

• Assess exposure of Wasmtime deployments to this vulnerability
• Apply patches for Wasmtime versions prior to v43
• Verify sandbox configurations and Wasm module validation
• Monitor for suspicious activity in Wasmtime environments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by bit-packing in the Cranelift compiler backend, which can result in silent overflow and incorrect value references in the IR. A specially crafted Wasm module can exploit this to escape the sandbox. The issue is fixed in Wasmtime v36.0.19 and v43. Defenders should verify sandbox configurations and Wasm module validation to mitigate this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.