---
id: CVE-2026-115889
aliases:
  - GHSA-897f-g5gm-fmxm
title: >-
  Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and
  miscompilation
summary: >-
  Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and
  miscompilation
severity: critical
cvss: 9.9
cwe:
  - CWE-197
  - CWE-843
vendor: wasmtime
product: wasmtime
ecosystem: rust
affected:
  - wasmtime < 36.0.19
  - 'wasmtime >= 37.0.0, < 43.0.0'
patched:
  - wasmtime 36.0.19
  - wasmtime 43.0.0
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T22:02:21Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-897f-g5gm-fmxm'
references:
  - url: >-
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
  - url: 'https://github.com/bytecodealliance/wasmtime/pull/12613'
  - url: 'https://github.com/bytecodealliance/wasmtime/pull/14818'
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
  - url: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19'
  - url: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0380.html'
  - url: 'https://github.com/advisories/GHSA-897f-g5gm-fmxm'
tags:
  - ghsa
  - rust
  - cve.org
ingestedAt: '2026-10-23T21:38:13.047Z'
---

## Overview

## Summary

In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.

Cranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.

## Impact

A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.

## Patches

Wasmtime v36.0.19 has been released which fixes this issue.

## Affected packages

- `wasmtime < 36.0.19`
- `wasmtime >= 37.0.0, < 43.0.0`

## Remediation

Upgrade to a patched release:

- `wasmtime 36.0.19`
- `wasmtime 43.0.0`