Technical impact
Wasmtime’s Cranelift backend on aarch64 can compile a Wasm ``br_table`` instruction with more than approximately 256,000 targets to an incorrect conditional branch target. This incorrect target allows the branch to jump to arbitrary code at a user‑controlled offset, so a user‑controlled Wasm module can escape the Wasmtime sandbox and execute code of its choosing. The vulnerability is an instance of CWE-190 and CWE-691, representing unsafe integer overflows and pointer or index manipulations that can lead to code execution.
Affected Systems
The issue affects Wasmtime, a WebAssembly runtime from Bytecodealliance. Versions prior to 36.0.19, 48.0.7, and 49.0.4 run the Cranelift backend on aarch64 and are vulnerable. Any installation of Wasmtime on an aarch64 architecture using the default Cranelift backend before those patches is impacted.
Risk and Exploitability
The CVSS score is 9.9, indicating critical severity. EPSS is < 1%, so the current exploitation probability is very low but nonzero, making the likelihood of compromise uncertain. The condition of the vulnerability—any user‑controlled Wasm module—means the attack is feasible whenever the vulnerable runtime is present. The issue is not listed in CISA KEV. Attackers could likely exploit this by deploying a malicious Wasm module within any application that loads Wasmtime on aarch64 without the patch.
Github GHSA