Skip to content
OpenAdvisories
Critical · 9.9 Public exploit CVE-2026-115893 EUVD-2026-109188GHSA-mghf-wjfp-p5xmRUSTSEC-2026-0379

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Published Oct 23, 2026 · Updated Oct 29, 2026 · Assigned by GitHub_M

Vendor: bytecodealliance Product: wasmtime Package: ascan Package: cleave Package: rust Package: rust-wasmtime Package: rust-wasmtime Package: wasmcloud Package: wasmtime Package: wizer Ecosystem: Azure Linux Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Affected products

VendorProductAffectedFixed
bytecodealliance wasmtime < 36.0.19, >= 37.0.0, < 48.0.7, >= 49.0.0, < 49.0.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-wasmtime 36.0.20+dfsg-1 —
Debian 13 rust-wasmtime No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rust-wasmtime No fix yet —
Ubuntu 26.04 LTS rust-wasmtime No fix yet —
Ubuntu 24.04 LTS rust-wasmtime No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 rust 1.75.0-31 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling ascan 2.13.0-r2 —
Wolfi rolling cleave 2.12.1-r1 —
Wolfi rolling wasmcloud 2.10.3-r3 —
Wolfi rolling wizer No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io wasmtime < 36.0.19 36.0.19 GHSA-mghf-wjfp-p5xm
crates.io wasmtime >= 37.0.0, < 48.0.7 48.0.7 GHSA-mghf-wjfp-p5xm
crates.io wasmtime >= 49.0.0, < 49.0.4 49.0.4 GHSA-mghf-wjfp-p5xm
crates.io wasmtime >= 0.0.0-0, < 36.0.19 · >= 37.0.0, < 48.0.7 · >= 49.0.0, < 49.0.4 36.0.19, 48.0.7, 49.0.4 RUSTSEC-2026-0379

References