Threat reportVulnerabilityTL-2026-4521
Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889, CVE-2026-115893)
Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889 (TL-2026-4521), also tracked as GHSA-897f-g5gm-fmxm, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-27. It has no confirmed attribution, affects Bytecode Alliance Wasmtime (Cranelift backend), CVE-2026-115889, references 2 CVEs (CVE-2026-115889, CVE-2026-115893), maps to 3 MITRE ATT&CK techniques (T1190, T1203, T1611), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4521
- Threat ID
- TL-2026-4521
- Also known as
- GHSA-897f-g5gm-fmxm, GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0380, RUSTSEC-2026-0379
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud services, telecoms, software development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
Malware and tooling: cargo-audit
How Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889 works
Two critical (CVSS 9.9) Wasmtime/Cranelift miscompilation flaws allow a crafted WebAssembly module to escape the sandbox: a silent overflow of bit-packed SSA value indices (all architectures, CVE-2026-115889) and an incorrect conditional branch target for very large br_table instructions on aarch64 (CVE-2026-115893). Patched in 36.0.19, 48.0.7, 49.0.4 and 50.0.0/43.0.0+; no in-the-wild exploitation, public PoC or CISA KEV listing reported as of 2026-10-26.
Wasmtime is the Bytecode Alliance's WebAssembly runtime, and Cranelift is its default compiler backend. Both vulnerabilities are compiler correctness bugs: a malicious but syntactically valid Wasm module causes Cranelift to emit machine code that violates the sandbox's memory/control-flow isolation guarantees. Embedders that compile or load untrusted Wasm (multi-tenant serverless/edge platforms, plugin hosts) are the exposed population.
CVE-2026-115889 (GHSA-897f-g5gm-fmxm, RUSTSEC-2026-0380; CWE-197 Numeric Truncation Error, CWE-843 Type Confusion) stems from Cranelift bit-packing SSA value indices into a 24-bit field in a way that silently overflows in release builds. Specially crafted modules with very large function bodies cause value references in the intermediate representation to alias the wrong values, producing type confusion and arbitrary miscompilation that can lead to sandbox escape on all architectures using the default Cranelift settings. Affected: Wasmtime before 36.0.19 and 37.0.0 up to (not including) 43.0.0. Wasmtime 43 fixed it by moving to full u32 indexing with explicit overflow limits (PR #12613); the 36.x LTS line received a backport in 36.0.19.
CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379; CWE-691 Insufficient Control Flow Management) affects only aarch64. When a Wasm br_table instruction has more than roughly 256,000 targets, the default-branch conditional offset is out of range and wraps, so the emitted branch jumps to an incorrect target at an attacker-controlled offset in other code. Per the advisory this affects aarch64 deployments since Cranelift's initial aarch64 support in 2020. Affected: before 36.0.19, 37.0.0 to before 48.0.7, and 49.0.0 to before 49.0.4 (fix in PR #14826).
Both carry CVSS v3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H per the CVE-2026-115889 advisory), published by GitHub as CNA around 2026-10-19 to 2026-10-23. Credited researchers: jaydns (CVE-2026-115889, reported with AI assistance) and ilyas-mallah (CVE-2026-115893). SOCRadar reports no public PoC and no in-the-wild exploitation as of 2026-10-26, and neither CVE is in CISA KEV; it notes that the public fixes expose the vulnerable compiler paths, raising urgency for platforms handling untrusted Wasm. Machine code already compiled by a vulnerable Cranelift (for example cached or precompiled .cwasm artifacts) retains the miscompilation, so remediation requires upgrading, rebuilding embedders and recompiling cached modules. No configuration workaround is documented; upgrading is the sole mitigation. Debian trixie (26.0.1) and sid (36.0.13) packages were listed as vulnerable/unfixed at the time of the Debian tracker snapshot.
MITRE ATT&CK techniques used in TL-2026-4521
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Privilege Escalation
Affected products and versions in Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
- Bytecode Alliance — Wasmtime (Cranelift backend), CVE-2026-115889
Vulnerable versions: < 36.0.19; >= 37.0.0, < 43.0.0
Fixed in: 36.0.19; 43.0.0 and later - Bytecode Alliance — Wasmtime / Cranelift on aarch64, CVE-2026-115893
Vulnerable versions: < 36.0.19; >= 37.0.0, < 48.0.7; >= 49.0.0, < 49.0.4
Fixed in: 36.0.19; 48.0.7; 49.0.4; 50.0.0 - Debian — wasmtime package
Vulnerable versions: trixie 26.0.1+dfsg-3; sid/forky 36.0.13+dfsg-1
Remediation for Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
Patches
- Wasmtime 36.0.19 (LTS backport, both CVEs)
- Wasmtime 43.0.0 and later (CVE-2026-115889)
- Wasmtime 48.0.7, 49.0.4 and 50.0.0 (CVE-2026-115893)
Immediate actions
- Upgrade Wasmtime to a fixed release: 36.0.19, 48.0.7, 49.0.4 or 50.0.0 (CVE-2026-115889 is also fixed in 43.0.0+)
- Rebuild and redeploy every application that embeds Wasmtime/Cranelift
- Recompile all cached or precompiled Wasm modules, since machine code from a vulnerable compiler retains the miscompilation
- Prioritize multi-tenant and edge/serverless platforms that compile untrusted Wasm, and aarch64 hosts for CVE-2026-115893
Workarounds
- No configuration workaround documented; upgrading is the sole mitigation
Longer-term hardening
- Run cargo-audit in CI against RUSTSEC-2026-0379 and RUSTSEC-2026-0380 and refresh lockfiles
- Defense-in-depth for untrusted Wasm: run runtimes in separate OS-level sandboxes (container/VM, seccomp, least-privilege users)
- Do not accept precompiled Wasm artifacts from untrusted sources; compile in a trusted pipeline
CVEs associated with Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
Weaknesses (CWE) in Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
Timeline of Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
- Cranelift gains initial aarch64 support in 2020; the advisory states CVE-2026-115893 affects aarch64 deployments since then (exact day not given by source).
- Both flaws reported to the Wasmtime project (jaydns for CVE-2026-115889 with AI assistance; ilyas-mallah for CVE-2026-115893); GitHub advisories GHSA-897f-g5gm-fmxm and GHSA-mghf-wjfp-p5xm dated this day.
- RUSTSEC-2026-0380 issued for CVE-2026-115889 (modified 2026-10-24).
- CVE-2026-115889 and CVE-2026-115893 published by GitHub as CNA, both CVSS v3.1 9.9; patches released in 36.0.19, 48.0.7, 49.0.4 and 50.0.0.
- As of this date SOCRadar reports no in-the-wild exploitation, no public PoC and no CISA KEV listing.
- SOCRadar publishes analysis highlighting urgency for multi-tenant platforms running untrusted WebAssembly.
Sources cited for Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889
- Wasmtime Sandbox Escape Flaws Patched in Cranelift (SOCRadar)
- GHSA-897f-g5gm-fmxm: Cranelift SSA value index bit-packing overflow (CVE-2026-115889)
- GHSA-mghf-wjfp-p5xm: Cranelift aarch64 br_table miscompilation (CVE-2026-115893)
- RUSTSEC-2026-0380: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- Debian Security Tracker: CVE-2026-115893
- Wasmtime fix PR #12613 (full u32 SSA value indexing)
- Wasmtime fix PR #14826 (aarch64 br_table branch target)
Detection coverage for TL-2026-4521
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4521 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.