# Wasmtime Cranelift Sandbox Escape Flaws (CVE-2026-115889, CVE-2026-115893)

> Two critical (CVSS 9.9) Wasmtime/Cranelift miscompilation flaws allow a crafted WebAssembly module to escape the sandbox: a silent overflow of bit-packed SSA value indices (all architectures, CVE-2026-115889) and an incorrect conditional branch target for very large br_table instructions on aarch64 (CVE-2026-115893). Patched in 36.0.19, 48.0.7, 49.0.4 and 50.0.0/43.0.0+; no in-the-wild exploitation, public PoC or CISA KEV listing reported as of 2026-10-26.

- **Published:** 2026-10-27T07:38:11Z
- **Last reviewed:** 2026-10-27T07:38:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4521
- **ID:** TL-2026-4521
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-115889, CVE-2026-115893

## Description

Wasmtime is the Bytecode Alliance's WebAssembly runtime, and Cranelift is its default compiler backend. Both vulnerabilities are compiler correctness bugs: a malicious but syntactically valid Wasm module causes Cranelift to emit machine code that violates the sandbox's memory/control-flow isolation guarantees. Embedders that compile or load untrusted Wasm (multi-tenant serverless/edge platforms, plugin hosts) are the exposed population.

CVE-2026-115889 (GHSA-897f-g5gm-fmxm, RUSTSEC-2026-0380; CWE-197 Numeric Truncation Error, CWE-843 Type Confusion) stems from Cranelift bit-packing SSA value indices into a 24-bit field in a way that silently overflows in release builds. Specially crafted modules with very large function bodies cause value references in the intermediate representation to alias the wrong values, producing type confusion and arbitrary miscompilation that can lead to sandbox escape on all architectures using the default Cranelift settings. Affected: Wasmtime before 36.0.19 and 37.0.0 up to (not including) 43.0.0. Wasmtime 43 fixed it by moving to full u32 indexing with explicit overflow limits (PR #12613); the 36.x LTS line received a backport in 36.0.19.

CVE-2026-115893 (GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379; CWE-691 Insufficient Control Flow Management) affects only aarch64. When a Wasm br_table instruction has more than roughly 256,000 targets, the default-branch conditional offset is out of range and wraps, so the emitted branch jumps to an incorrect target at an attacker-controlled offset in other code. Per the advisory this affects aarch64 deployments since Cranelift's initial aarch64 support in 2020. Affected: before 36.0.19, 37.0.0 to before 48.0.7, and 49.0.0 to before 49.0.4 (fix in PR #14826).

Both carry CVSS v3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H per the CVE-2026-115889 advisory), published by GitHub as CNA around 2026-10-19 to 2026-10-23. Credited researchers: jaydns (CVE-2026-115889, reported with AI assistance) and ilyas-mallah (CVE-2026-115893). SOCRadar reports no public PoC and no in-the-wild exploitation as of 2026-10-26, and neither CVE is in CISA KEV; it notes that the public fixes expose the vulnerable compiler paths, raising urgency for platforms handling untrusted Wasm. Machine code already compiled by a vulnerable Cranelift (for example cached or precompiled .cwasm artifacts) retains the miscompilation, so remediation requires upgrading, rebuilding embedders and recompiling cached modules. No configuration workaround is documented; upgrading is the sole mitigation. Debian trixie (26.0.1) and sid (36.0.13) packages were listed as vulnerable/unfixed at the time of the Debian tracker snapshot.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1611 Escape to Host

## Sources

- [Wasmtime Sandbox Escape Flaws Patched in Cranelift (SOCRadar)](https://socradar.io/blog/wasmtime-sandbox-escape-cranelift/)
- [GHSA-897f-g5gm-fmxm: Cranelift SSA value index bit-packing overflow (CVE-2026-115889)](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm)
- [GHSA-mghf-wjfp-p5xm: Cranelift aarch64 br_table miscompilation (CVE-2026-115893)](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm)
- [RUSTSEC-2026-0380: Bit-packing in Cranelift compiler causes silent overflow and miscompilation](https://rustsec.org/advisories/RUSTSEC-2026-0380.html)
- [Debian Security Tracker: CVE-2026-115893](https://security-tracker.debian.org/tracker/CVE-2026-115893)
- [Wasmtime fix PR #12613 (full u32 SSA value indexing)](https://github.com/bytecodealliance/wasmtime/pull/12613)
- [Wasmtime fix PR #14826 (aarch64 br_table branch target)](https://github.com/bytecodealliance/wasmtime/pull/14826)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4521