Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115889— Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Quick assessment

Affected
bytecodealliance wasmtime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wasmtime 是一个 WebAssembly 运行时。在 36.0.19 和 43.0.0 版本之前，其 Cranelift 编译器后端在发布构建（release builds）中会以位打包（bit-pack）的方式存储 SSA 值索引。当编译包含大量 SSA 值的足够大或经过特殊构造的 Wasm 函数时，这种打包方式可能静默地发生溢出。该溢出会导致 Cranelift 引用错误的中间表示（IR）值，从而引发任意误编译、类型混淆以及其他由攻击者控制的影响，这些影响可能突破 Wasm 沙箱的隔离，且在任何使用默认

CVSS 9.9 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115889

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Source: CVE Program / CVE List V5
Vulnerability Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
数值截断错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
bytecodealliance wasmtime < 36.0.19 -

II. Public POCs for CVE-2026-115889

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115889

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115889 (2)

Vendor Advisories for CVE-2026-115889 (1)

Vendor Pages for CVE-2026-115889 (1)

Same Patch Batch · bytecodealliance · 2026-10-23 · 3 CVEs total

CVE-2026-115893 9.9 CRITICAL Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_tabl
CVE-2026-115892 5.7 MEDIUM Wasmtime: Panic lowering a host-created component model stream into a guest that expects a

IV. Related Vulnerabilities

Same product: wasmtime
Same vendor: bytecodealliance
Same weakness: CWE-197

V. Comments for CVE-2026-115889

No comments yet

Leave a comment