Vulnerabilities · 5h ago

Wasmtime flaws let WebAssembly escape sandboxing

The Bytecode Alliance disclosed two critical flaws in Wasmtime’s Cranelift compiler on October 19 that could let attacker-controlled WebAssembly modules escape sandboxing. One flaw affects all processor architectures; the other affects ARM64 only. Fixed releases followed on October 19 and 20, and the maintainers have reported no attacks.

Cranelift turns WebAssembly modules into machine code. The flaws let a specially controlled module get past checks that restrict its memory and where its code can jump, potentially crossing the runtime’s boundary. The advisories do not say what an attacker could access after escaping.

If a service accepts outside WebAssembly and bundles Wasmtime, the vulnerable runtime may be inside that product rather than a visible standalone installation. Some ARM64 releases that fixed an earlier escape remain vulnerable to the second flaw; the extent of access after an escape is still unspecified.

CVE-2026-115889

NVD KEV

CVSS 9.9 CRITICAL: wasmtime is a runtime for WebAssembly. EPSS 0.5% (39th percentile).

CVE-2026-115893

NVD KEV

CVSS 9.9 CRITICAL: wasmtime is a runtime for WebAssembly. EPSS 0.4% (37th percentile).

Timeline

Oct 26 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Oct 26
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Wasmtime fixes two critical Cranelift flaws that could let attacker-controlled WebAssembly modules escape sandboxes, including an ARM64-only bug.

Entities

CVE-2026-115889
CVE-2026-115893

Part of the PlainSec briefing for 2026-10-26

Editions

Briefing for 2026-10-26

Vulnerabilities · 5h agoWasmtime flaws let WebAssembly escape sandboxingThe Bytecode Alliance disclosed two critical flaws in Wasmtime’s Cranelift compiler on October 19 that could let attacker-controlled WebAssembly modules escape sandboxing. One flaw affects all processor architectures; the other affects ARM64 only. Fixed releases followed on October 19 and 20, and the maintainers have reported no attacks.Cranelift turns WebAssembly modules into machine code. The flaws let a specially controlled module get past checks that restrict its memory and where its code can jump, potentially crossing the runtime’s boundary. The advisories do not say what an attacker could access after escaping.If a service accepts outside WebAssembly and bundles Wasmtime, the vulnerable runtime may be inside that product rather than a visible standalone installation. Some ARM64 releases that fixed an earlier escape remain vulnerable to the second flaw; the extent of access after an escape is still unspecified.