Wasmtime Cranelift compiler type confusion enables sandbox escape
Cranelift compiler bug in Wasmtime mishandles numeric value tracking in large functions, enabling type confusion and WebAssembly sandbox escape. CVSS 9.9. Patched in 36.0.19, 48.0.7, 49.0.4, 50.0.0.
- Vendor
- Bytecode Alliance
- Product
- Wasmtime
- CVSS
- 9.9
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-115889 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-115889 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-26 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-26. Full cross-catalog view: /kev-comparison
CVE-2026-115889 timeline
- Patch available-4d (before NVD)Fixed in 36.0.19 and 48.0.7 (Oct 19); 49.0.4 and 50.0.0 (Oct 20)
- Published to NVD
- First 0dayNews coverage+3d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Cranelift compiler in Wasmtime handles translation of WebAssembly bytecode to native machine code. In large WebAssembly functions, Cranelift mishandled numeric value tracking, allowing it to reference the wrong value. This produces incorrect machine code that can lead to type confusion, opening a path for a malicious WebAssembly module to escape its sandbox.
The flaw affects all processor architectures. Wasmtime versions before 36.0.19 and 37.0.0 through 42.x are vulnerable. Update to 36.0.19 (stable branch) or 48.0.7, 49.0.4, or 50.0.0 for later branches. There is no workaround.
See the vendor advisory for full technical details.
Other Bytecode Alliance CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-115893 Wasmtime br_table jump table overflow enables sandbox escape on ARM64write-up | [ CRITICAL ] | 9.9 | — | — |
