The Bytecode Alliance disclosed two critical flaws in Wasmtime’s Cranelift compiler on October 19 that could let attacker-controlled WebAssembly modules escape sandboxing. One flaw affects all processor architectures; the other affects ARM64 only. Fixed releases followed on October 19 and 20, and the maintainers have reported no attacks.
Cranelift turns WebAssembly modules into machine code. The flaws let a specially controlled module get past checks that restrict its memory and where its code can jump, potentially crossing the runtime’s boundary. The advisories do not say what an attacker could access after escaping.
If a service accepts outside WebAssembly and bundles Wasmtime, the vulnerable runtime may be inside that product rather than a visible standalone installation. Some ARM64 releases that fixed an earlier escape remain vulnerable to the second flaw; the extent of access after an escape is still unspecified.