cyfenced.com →

[ CVE-2026-115889 · Published 23 Oct 2026 ]

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

CVSS 9.9 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.9

[ Description ]Official description

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

[ Fixes ]Fixes and patches

  • wasmtime 36.0.19Fixed version · GitHub Advisories · rust package wasmtime: upgrade to 36.0.19 or later (affected < 36.0.19)
  • wasmtime 43.0.0Fixed version · GitHub Advisories · rust package wasmtime: upgrade to 43.0.0 or later (affected >= 37.0.0, < 43.0.0)

[ Packages ]Affected open-source packages

[ References ]References