Wasmtime br_table jump table overflow enables sandbox escape on ARM64
ARM64-only Wasmtime flaw: br_table instruction overflows its jump table, silently redirecting execution to attacker-controlled locations and escaping the WebAssembly sandbox. CVSS 9.9.
- Vendor
- Bytecode Alliance
- Product
- Wasmtime
- CVSS
- 9.9
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-115893 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-115893 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-26 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-26. Full cross-catalog view: /kev-comparison
CVE-2026-115893 timeline
- Patch available-4d (before NVD)Fixed in 36.0.19 and 48.0.7 (Oct 19); 49.0.4 and 50.0.0 (Oct 20)
- Published to NVD
- First 0dayNews coverage+3d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Wasmtime’s br_table instruction implements WebAssembly’s switch-like branching. On ARM64/aarch64 systems, when a jump table for br_table exceeded its capacity limit, the branch silently pointed to the wrong location. An attacker controlling WebAssembly input can craft a module that exploits this to redirect execution to arbitrary code locations, escaping the sandbox.
The flaw is ARM64-specific. Wasmtime versions from 36.0.0 through 48.0.6 and 49.0.0 through 49.0.3 are vulnerable to this CVE (some of those ranges also carry CVE-2026-115889). Update to 36.0.19, 48.0.7, 49.0.4, or 50.0.0. There is no workaround.
See the vendor advisory for full technical details.
Other Bytecode Alliance CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-115889 Wasmtime Cranelift compiler type confusion enables sandbox escapewrite-up | [ CRITICAL ] | 9.9 | — | — |
