CVE-2026-115893: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm brtable instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.19 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.7 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are Wasmtime engines running on aarch64 that use the default Cranelift backend and execute user-controlled WebAssembly modules. The issue applies to versions before 36.0.19, 48.0.7, and 49.0.4.
What must an attacker provide to exploit this issue?
An attacker needs the ability to run a user-controlled Wasm module containing a br_table instruction with more than approximately 256,000 targets. No user interaction is required, but the attacker must have the privileges needed to submit or execute that module.
Is the default configuration affected?
Yes. The vulnerability affects aarch64 engines using Wasmtime's default Cranelift compiler backend.
What is the impact of successful exploitation?
The incorrectly compiled conditional branch can jump to arbitrary other code at a user-controlled offset. This can allow the user-controlled Wasm module to escape the Wasmtime sandbox.
Which versions contain the fix?
Upgrade to Wasmtime 36.0.19, 48.0.7, or 49.0.4, depending on the release line in use.