CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Vulnerability summary

CVE-2026-115889 is a critical (CVSS 9.9) Numeric Truncation Error vulnerability in bytecodealliance wasmtime.

Timeline

1. 23-10-2026
   PublishedVulnerability first disclosed.

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

• CWE-197Numeric Truncation ErrorTruncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.