Wasmtime Patches Two Critical Sandbox Escapes

Bytecode Alliance patched two critical flaws in Wasmtime, its open-source WebAssembly runtime, on October 19 and 20, 2026. Both carry CVSS 9.9 and allow a malicious WebAssembly module to escape the sandbox.

CVE-2026-115889 (all architectures): The Cranelift compiler, which Wasmtime uses by default to translate WebAssembly to native code, mishandled numeric value tracking inside large functions. The resulting incorrect machine code opens a path to type confusion and sandbox escape.

CVE-2026-115893 (ARM64/aarch64 only): The br_table instruction could overflow its jump table, silently redirecting execution outside the valid range. On ARM64 hosts, an attacker with control over WebAssembly input can use this to redirect execution to arbitrary locations.

Neither bug is confirmed exploited in the wild. Neither appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing.

What to patch

There is no workaround for either flaw. Update Wasmtime based on your running version:

If Wasmtime is embedded inside another application, plugin host, or serverless compute layer, verify what version ships in that dependency and whether an upstream patch is available. The Brotli decoder flaw that propagated into Node.js and Bun last week shows how embedded runtime bugs spread before users realize they are exposed. Check your dependency tree.

For deployments using Wasmtime for untrusted module execution or plugin isolation, this is a high-priority patch: the sandbox is the entire security boundary, and both of these flaws break it.

Related: Postiz Patches Critical Token Confusion Bug, CVSS 9.9 | Next.js Out-of-Band Update Fixes Two Critical RCEs