CVE-2026-115893

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Affected

bytecodealliance · wasmtime

CVSS v3.1 GITHUB

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.99% chance of exploitation in the next 30 days, 62nd percentile

Published

2026-10-23

Updated

2026-10-29

Proof-of-concept exploits (1)

• shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escapeRepo stars 0★ · pushed 2026-10-27 · find archive
  2 files

  poc/gen_jit_escape.pypoc/gen_jit_escape_linux.py

CVE references

• advisories/GHSA-mghf-wjfp-p5xmADVISORY
• bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abdREFERENCE
• bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618REFERENCE
• bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbeREFERENCE
• bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aaREFERENCE
• bytecodealliance/wasmtime/pull/14818REFERENCE
• bytecodealliance/wasmtime/pull/14819REFERENCE
• bytecodealliance/wasmtime/pull/14820REFERENCE
• bytecodealliance/wasmtime/pull/14826REFERENCE
• bytecodealliance/wasmtime/releases/tag/v36.0.19REFERENCE
• bytecodealliance/wasmtime/releases/tag/v48.0.7REFERENCE
• bytecodealliance/wasmtime/releases/tag/v49.0.4REFERENCE
• bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xmREFERENCE

References

• CVE Record
• NVD entry

Related

• CVE-2025-27410
• CVE-2025-55182