9.9

CVE-2026-115893: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Deferred
Published 23-10-2026Last modified 23-10-2026

Vulnerability summary

CVE-2026-115893 is a critical (CVSS 9.9) Insufficient Control Flow Management vulnerability in bytecodealliance wasmtime.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)
EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 23-10-2026
    PublishedVulnerability first disclosed.

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Bytecodealliance1 product
  • wasmtime< 36.0.19 | ≥ 37.0.0, < 48.0.7 | ≥ 49.0.0, < 49.0.4

1 vendor · 1 product

References

12 links
Show all 12 references