{"id":"CVE-2026-115893","title":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","summary":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect condi…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-691"],"vendor":"bytecodealliance","product":"wasmtime","affected":["wasmtime < 36.0.19","wasmtime >= 37.0.0, < 48.0.7","wasmtime >= 49.0.0, < 49.0.4"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:29:33.917Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115893","references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","label":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","label":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","label":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","label":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14826","label":"https://github.com/bytecodealliance/wasmtime/pull/14826"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","label":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","label":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","label":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","label":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T21:38:13.047Z","slug":"CVE-2026-115893","body":"## Overview\n\nWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.\n\n## Affected\n\n- `wasmtime < 36.0.19`\n- `wasmtime >= 37.0.0, < 48.0.7`\n- `wasmtime >= 49.0.0, < 49.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":54.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}