CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Summary
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.
Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.
Impact
A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.
Patches
Wasmtime v36.0.19 has been released which fixes this issue.
Other sources
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/wasmtimeto a version that resolves this vulnerability.Fixed in 43.0.0 - Upgrade
Upgrade
rust/wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.19 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.19
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Wasmtime's default Cranelift compiler backend are affected on any architecture. The issue can permit attacker-controlled effects that escape the WebAssembly sandbox.
What does an attacker need to exploit this issue?
An attacker needs the ability to cause compilation of a sufficiently large or specially crafted WebAssembly function containing many SSA values. The supplied severity vector indicates low privileges are required and no user interaction is required.
Which versions contain the fix?
The issue is fixed in Wasmtime versions 36.0.19 and 43.0.0. Versions prior to those fixed releases are affected.