CVE-2026-115893: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Summary
When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one brtable instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes.
Impact
Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected.
Patches
Wasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.
Other sources
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
— Ubuntu
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm brtable instruction
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.4 - Upgrade
Upgrade
rust/wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.7 - Upgrade
Upgrade
rust/wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.19 - Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20+dfsg-1 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are Wasmtime engines running on aarch64 that use the default Cranelift backend and execute user-controlled WebAssembly modules. The issue applies to versions before 36.0.19, 48.0.7, and 49.0.4.
What must an attacker provide to exploit this issue?
An attacker needs the ability to run a user-controlled Wasm module containing a br_table instruction with more than approximately 256,000 targets. No user interaction is required, but the attacker must have the privileges needed to submit or execute that module.
Is the default configuration affected?
Yes. The vulnerability affects aarch64 engines using Wasmtime's default Cranelift compiler backend.
What is the impact of successful exploitation?
The incorrectly compiled conditional branch can jump to arbitrary other code at a user-controlled offset. This can allow the user-controlled Wasm module to escape the Wasmtime sandbox.
Which versions contain the fix?
Upgrade to Wasmtime 36.0.19, 48.0.7, or 49.0.4, depending on the release line in use.