Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical flaws in Wasmtime , a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
Two critical flaws in Wasmtime , a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
Wasmtime's maintainers at the Bytecode Alliance rated each flaw 9.9 out of 10 on the CVSS scale in advisories published on October 19.
Neither flaw was in the Known Exploited Vulnerabilities catalog kept by the U.S.
ARM64 hosts that updated to 36.0.7, 42.0.2, or 43.0.1 in April to fix an earlier Cranelift sandbox escape on ARM64 are still affected by CVE-2026-115893.
An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems; fastly, for example, says its Compute platform runs customer code using Wasmtime .
The two flaws were fixed at different times, so whether your version is affected depends on your release line and, for one flaw, your processor architecture.
Because both flaws need a module the attacker controls, the risk is highest for services that compile modules written by other people.
CVE-2026-115893 involves br_table, a WebAssembly instruction that jumps to one of many places in the code based on an index, and fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks.
As of October 26, GitHub's advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893.
Update to the fixed release for your line: 36.0.19 , 48.0.7 , or 49.0.4 ; gitHub says only reviewed entries trigger Dependabot alerts , so Dependabot users should not expect an alert for the ARM64 flaw.
What happened
Two critical flaws in Wasmtime , a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
Wasmtime's maintainers at the Bytecode Alliance rated each flaw 9.9 out of 10 on the CVSS scale in advisories published on October 19.
What changed
Neither flaw was in the Known Exploited Vulnerabilities catalog kept by the U.S.
ARM64 hosts that updated to 36.0.7, 42.0.2, or 43.0.1 in April to fix an earlier Cranelift sandbox escape on ARM64 are still affected by CVE-2026-115893.
Who is affected
An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems; fastly, for example, says its Compute platform runs customer code using Wasmtime .
Why it matters
The two flaws were fixed at different times, so whether your version is affected depends on your release line and, for one flaw, your processor architecture.
Because both flaws need a module the attacker controls, the risk is highest for services that compile modules written by other people.
Technical details
CVE-2026-115893 involves br_table, a WebAssembly instruction that jumps to one of many places in the code based on an index, and fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks.
As of October 26, GitHub's advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893.
Response
Update to the fixed release for your line: 36.0.19 , 48.0.7 , or 49.0.4 ; gitHub says only reviewed entries trigger Dependabot alerts , so Dependabot users should not expect an alert for the ARM64 flaw.
What security teams should do
A module can only use its own memory and the host functions it is given, and its code can only jump to checked locations.
Both flaws are listed in RustSec, the database the cargo-audit tool uses to check Cargo.lock files, as RUSTSEC-2026-0380 and RUSTSEC-2026-0379 .
Attribution
The Hacker News: Two critical flaws in Wasmtime , a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.