{"id":"CVE-2026-115893","aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"url":"https://o3.security/vulnerability/CVE-2026-115893","summary":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","details":"## Summary\n\nWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one `br_table` instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes.\n\n## Impact\n\nAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected.\n\n## Patches\n\nWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.","published":"2026-10-23T21:29:33.917Z","modified":"2026-10-30T02:30:48.099453673Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"36.0.19"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"48.0.7"},{"ecosystem":"crates.io","name":"wasmtime","fixedVersion":"49.0.4"}],"fix":{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","label":"bytecodealliance/wasmtime@222ff3a"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115893.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14826"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0379.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-30T02:30:48.099453673Z"}}