Wasmtime’s Cranelift backend on aarch64 can compile a Wasm ``br_table`` instruction with more than approximately 256,000 targets to an incorrect conditional branch target. This incorrect target allows the branch to jump to arbitrary code at a user‑controlled offset, so a user‑controlled Wasm module can escape the Wasmtime sandbox and execute code of its choosing. The vulnerability is an instance of CWE-691, which represents unsafe manipulations of pointers or indices that can lead to code execution.

The issue affects Wasmtime, a WebAssembly runtime from Bytecodealliance. Versions prior to 36.0.19, 48.0.7, and 49.0.4 run the Cranelift backend on aarch64 and are vulnerable. Any installation of Wasmtime on an aarch64 architecture using the default Cranelift backend before those patches is impacted.

The CVSS score is 9.9, indicating critical severity. EPSS is not available, making the current exploitation probability unclear, but the condition of the vulnerability—any user‑controlled Wasm module—means the attack is feasible whenever the vulnerable runtime is present. The issue is not listed in CISA KEV, but the impact is a full sandbox escape that could lead to arbitrary code execution on the host. Attackers could likely exploit this by deploying a malicious Wasm module within any application that loads Wasmtime on aarch64 without the patch.