Wasmtime's Cranelift compiler backend bit‑packs SSA value indices in a way that can silently overflow when compiling very large or specially crafted WebAssembly modules. This overflow causes Cranelift to reference incorrect IR values, leading to arbitrary miscompilation, type confusion and other attacker‑controlled effects. The result is that malicious WebAssembly code can escape the sandbox on any architecture that uses the default Cranelift backend.

All instances of bytecodealliance:wasmtime earlier than versions 36.0.19 and 43.0.0 are affected. The vulnerability applies to any deployment that compiles and executes WebAssembly modules with the Cranelift backend in release builds.

With a CVSS score of 9.9, the vulnerability is considered critical. The EPSS score is not available and the issue is not listed in CISA KEV, but the nature of the flaw means that any entity capable of providing a WebAssembly module to the runtime can trigger the overflow. The attack requires no user interaction beyond loading a malicious module, making the risk high for public or untrusted WebAssembly execution environments.