CVE-2026-115889

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

View on CVE.org
Published Oct 23, 2026 CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Analysis

AI-generated

Technical impact

Wasmtime's Cranelift compiler backend bit‑packs SSA value indices in a way that can silently overflow when compiling very large or specially crafted WebAssembly modules. This overflow causes Cranelift to reference incorrect IR values, leading to arbitrary miscompilation, type confusion and other attacker‑controlled effects. The result is that malicious WebAssembly code can escape the sandbox on any architecture that uses the default Cranelift backend.

Affected Systems

All instances of bytecodealliance:wasmtime earlier than versions 36.0.19 and 43.0.0 are affected. The vulnerability applies to any deployment that compiles and executes WebAssembly modules with the Cranelift backend in release builds.

Risk and Exploitability

With a CVSS score of 9.9, the vulnerability is considered critical. The EPSS score is low (<1%) and the issue is not listed in CISA KEV, but the nature of the flaw means that any entity capable of providing a WebAssembly module to the runtime can trigger the overflow. The attack requires no user interaction beyond loading a malicious module, making the risk high for public or untrusted WebAssembly execution environments.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Wasmtime to at least version 36.0.19 or 43.0.0, which contain the fix for the Cranelift bit‑packing overflow.
  • Confirm that the runtime is using the Cranelift backend; if an alternate backend is in use, still upgrade for consistency and to avoid any unknown interactions.
  • As a temporary measure, validate incoming WebAssembly binaries to ensure they do not contain an overly large number of SSA values, or otherwise limit the module size, while awaiting an upgrade.

Generated by OpenCVE AI on October 29, 2026 at 14:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
History
Type Values Removed Values Added
Weaknesses CWE-190
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Bytecodealliance
Bytecodealliance wasmtime
Vendors & Products Bytecodealliance
Bytecodealliance wasmtime
Type Values Removed Values Added
Description Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Title Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Weaknesses CWE-197
CWE-843
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}
Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-197

    Numeric Truncation Error

  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Oct 26, 2026, 5:42 PM
Reserved
Oct 23, 2026, 7:37 PM

View source JSON

Updated
Oct 26, 2026, 3:40 PM

JSON

Status
Deferred
Published
Oct 23, 2026, 10:16 PM
Modified
Oct 26, 2026, 6:17 PM

View source JSON

Severity
Important
Public date
Oct 23, 2026, 9:23 PM

View source Bugzilla JSON

Updated
Oct 29, 2026, 2:15 PM

JSON