AZL-111434: CVE-2026-115893 affecting package rust 1.96.1-2

Q: Which deployments are exposed to this issue?

The issue affects Wasmtime engines running on aarch64 that use the default Cranelift backend and execute user-controlled WebAssembly modules. Other architectures are not identified as affected in the provided information.

Q: What must an attacker provide to exploit the vulnerability?

An attacker needs to supply a WebAssembly module containing a br_table instruction with more than approximately 256,000 targets. Successful exploitation can cause a branch to jump to other code at an attacker-controlled offset.

Q: Is the default configuration affected?

Yes. The affected scenario explicitly includes aarch64 Wasmtime engines using the default Cranelift backend.

Q: Which Wasmtime versions contain fixes?

The issue is fixed in Wasmtime versions 36.0.19, 48.0.7, and 49.0.4.

Published Oct 23, 2026

Updated

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Affected Software

1 affected component

azure-linux/rust>=1.85.0<=1.96.1-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 36.0.19
Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 48.0.7
Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 49.0.4

Event History

Oct 23, 2026

Advisory Published

via OSV·10:16 PM

Data Sourced

via OSV·10:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115893

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Wasmtime engines running on aarch64 that use the default Cranelift backend and execute user-controlled WebAssembly modules. Other architectures are not identified as affected in the provided information.

What must an attacker provide to exploit the vulnerability?

An attacker needs to supply a WebAssembly module containing a br_table instruction with more than approximately 256,000 targets. Successful exploitation can cause a branch to jump to other code at an attacker-controlled offset.

Is the default configuration affected?

Yes. The affected scenario explicitly includes aarch64 Wasmtime engines using the default Cranelift backend.

Which Wasmtime versions contain fixes?

The issue is fixed in Wasmtime versions 36.0.19, 48.0.7, and 49.0.4.

AZL-111434: CVE-2026-115893 affecting package rust 1.96.1-2

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to exploit the vulnerability?

Is the default configuration affected?

Which Wasmtime versions contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to exploit the vulnerability?

Is the default configuration affected?

Which Wasmtime versions contain fixes?