Two critical security flaws in Wasmtime, a WebAssembly runtime that can be integrated into other software applications, could allow specially crafted WebAssembly modules to escape the sandbox environment designed to isolate them. The vulnerabilities were disclosed by Wasmtime maintainers at Bytecode Alliance, who released updated versions to address the issues. No active exploitation has been reported, and researchers noted that an attacker would first require access to a vulnerable Wasmtime build and the ability to provide a WebAssembly module under their control. Both vulnerabilities affect Cranelift, the compiler component used by Wasmtime to convert WebAssembly code into machine instructions. The maintainers assigned both issues a high severity rating of 9.9 out of 10 on the CVSS scale in security advisories published on October 19. One vulnerability, tracked as CVE-2026-115889, affects Wasmtime across supported processor architectures, while CVE-2026-115893 impacts only ARM64, also known as aarch64, systems.
Wasmtime is designed to execute WebAssembly code outside traditional web browsers while maintaining isolation through sandbox controls. These protections limit a module’s access to memory, restrict available host functions and ensure that code execution follows approved paths. A successful sandbox escape could allow a malicious WebAssembly module to move beyond those restrictions, creating risks for services that execute code supplied by external users. Security researchers explained that the risk is particularly relevant for platforms and services that allow customers or third parties to run WebAssembly modules. For example, Fastly’s Compute platform uses Wasmtime to execute customer code. However, the advisories did not identify affected services or specify what access could be obtained after a successful sandbox escape.
The first vulnerability, CVE-2026-115889, is linked to how Cranelift handled internal value tracking during compilation. Before version 43, certain numerical values used by the compiler were stored in 24-bit fields. In release builds, values exceeding those limits could overflow without generating an error, potentially causing incorrect references during code generation. Researchers said specially designed WebAssembly functions could use this behavior to create type confusion and bypass sandbox protections. The second issue, CVE-2026-115893, affects ARM64 systems and involves the handling of the WebAssembly br_table instruction, which allows code execution to jump between multiple possible locations based on an index value. According to the advisory, an out-of-range index could be directed through an incorrect branch when very large jump tables were created. A specially crafted module could use this behavior to reach unintended code locations.
Wasmtime maintainers released fixes through updated versions, including 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Users running unsupported release lines are advised to move to supported versions. Since Wasmtime can be included as a library inside other software, updating only the standalone command-line tool may not resolve the issue. Applications that integrate Wasmtime need to be rebuilt with patched versions. The vulnerabilities are also tracked in RustSec, the security advisory database used by tools such as cargo-audit. The issues were listed as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. Developers using Wasmtime-based applications are advised to review their dependencies, update affected components and ensure that security controls remain enabled. The disclosure highlights the importance of maintaining secure software supply chains as WebAssembly adoption expands across cloud platforms, serverless environments and application infrastructure. Regular dependency updates and monitoring remain important measures for organizations relying on runtime technologies that execute externally supplied code.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
