{"schema":"threatline.record/2","record":{"id":"CVE-2026-115889","aliases":["GHSA-897f-g5gm-fmxm","RUSTSEC-2026-0380"],"summary":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","details":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.\n\n## Impact\n\nA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.\n\n## Patches\n\nWasmtime v36.0.19 has been released which fixes this issue.","categories":["Libraries & packages"],"product":"wasmtime","vendor":"bytecodealliance","ecosystem":"rust","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:02:21Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"range":"< 36.0.19"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:02:21Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"range":">= 37.0.0, < 43.0.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115889","source_modified_at":"2026-10-23T21:23:27.669Z","fetched_at":"2026-10-23T21:47:51.402276Z","product":"wasmtime","vendor":"bytecodealliance","versions":[{"status":"affected","version":"< 36.0.19"},{"status":"affected","version":">= 37.0.0, < 43.0.0"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:25:51.511659839Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"36.0.19"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:25:51.511659839Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"43.0.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:02:21Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"version":"36.0.19"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:02:21Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"ecosystem":"rust","name":"wasmtime"},"version":"43.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:25:51.511659839Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"version":"36.0.19"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-897f-g5gm-fmxm","source_modified_at":"2026-10-23T22:25:51.511659839Z","fetched_at":"2026-10-24T00:31:04.721601Z","package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"version":"43.0.0"}],"cvss":9.9,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T21:23:27.669Z","modified_at":"2026-10-23T22:25:51.511659839Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T22:02:21Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115889","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:23:27.669Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-897f-g5gm-fmxm","fetched_at":"2026-10-24T00:31:04.721601Z","source_modified_at":"2026-10-23T22:25:51.511659839Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/pull/12613","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0","tags":["x_refsource_MISC"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0380.html","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T22:25:51.511659839Z","content_hash":"ba9edd507bb8555d254bca1e0e67616da8ca463b260632707da0c5680ff5e9ec"}}