Skip to content
OpenAdvisories
Critical · 9.9 Public exploit CVE-2026-115889 EUVD-2026-109186GHSA-897f-g5gm-fmxmRUSTSEC-2026-0380

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Published Oct 23, 2026 · Updated Oct 26, 2026 · Assigned by GitHub_M

Vendor: bytecodealliance Product: wasmtime Package: rust Package: rust-wasmtime Package: rust-wasmtime Package: wasmtime Ecosystem: Azure Linux Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Affected products

VendorProductAffectedFixed
bytecodealliance wasmtime < 36.0.19, >= 37.0.0, < 43.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-wasmtime 36.0.20+dfsg-1 —
Debian 13 rust-wasmtime No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-wasmtime No fix yet —
Ubuntu 26.04 LTS rust-wasmtime No fix yet —
Ubuntu 24.04 LTS rust-wasmtime No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rust 1.75.0-31 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • ideator-labs/wasmtime-sweep ★ 0 · Oct 27, 2026

    Find every Wasmtime engine embedded in binaries, wheels, NuGet packages and layers, and check CVE-2026-115889/115893

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io wasmtime < 36.0.19 36.0.19 GHSA-897f-g5gm-fmxm
crates.io wasmtime >= 37.0.0, < 43.0.0 43.0.0 GHSA-897f-g5gm-fmxm
crates.io wasmtime >= 0.0.0-0, < 36.0.19 · >= 37.0.0, < 43.0.0 36.0.19, 43.0.0 RUSTSEC-2026-0380

References