CVE-2026-115889 (CVSS 9.9)

Description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Is your site exposed to CVE-2026-115889?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-197 CWE-197

CWE-843 CWE-843

References

Other References

https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0 https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa https://github.com/bytecodealliance/wasmtime/pull/12613 https://github.com/bytecodealliance/wasmtime/pull/14818 https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19 https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0 https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm

Frequently Asked Questions

What is CVE-2026-115889? +

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0. It has a CVSS v3.1 base score of 9.9 (CRITICAL).

How severe is CVE-2026-115889? +

CVE-2026-115889 has a CVSS v3.1 score of 9.9 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

How do I check if I'm vulnerable to CVE-2026-115889? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a …

CVE-2026-105768

apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version …

CVE-2026-76151

Out-of-bounds read (buffer over-read) in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 …

CVE-2026-65610

nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. An attacker who can influence …

CVE-2026-96113 9.8

Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.

CVE-2024-43639 9.8

Windows KDC Proxy Remote Code Execution Vulnerability

CVE-2026-115889