GHSA-897f-g5gm-fmxm: Critical severity rust/wasmtime vulnerability

Q: Who is exposed to this vulnerability?

Wasmtime engines using the default Cranelift backend are affected on any architecture or platform. The issue can allow a specially crafted WebAssembly module to escape the sandbox.

Q: What does an attacker need to exploit it?

An attacker needs to cause the engine to compile a very large WebAssembly function body or a specially crafted function that uses many SSA values. The supplied severity vector indicates network reachability, low attack complexity, no user interaction, and that the attacker requires low privileges.

Q: Are default Wasmtime configurations affected?

Yes. The advisory states that a Wasmtime engine with default settings, which uses the Cranelift backend, is susceptible.

Q: Which versions contain a fix?

Wasmtime v36.0.19 fixes the issue. Wasmtime v43 also uses full u32 SSA value indices with checks when the limit is exceeded, removing susceptibility to this overflow.

Published Oct 23, 2026

Updated

Summary

In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.

Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.

Impact

A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.

Patches

Wasmtime v36.0.19 has been released which fixes this issue.

Affected Software

2 affected componentsFixes available

rust/wasmtime>=37.0.0<43.0.0

43.0.0

rust/wasmtime<36.0.19

36.0.19

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/wasmtime to a version that resolves this vulnerability.
Fixed in 43.0.0
Upgrade
Upgrade rust/wasmtime to a version that resolves this vulnerability.
Fixed in 36.0.19
Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in v36.0.19

Event History

Oct 23, 2026

Advisory Published

via GitHub·10:02 PM

Data Sourced

via GitHub·10:02 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this vulnerability?

Wasmtime engines using the default Cranelift backend are affected on any architecture or platform. The issue can allow a specially crafted WebAssembly module to escape the sandbox.

What does an attacker need to exploit it?

An attacker needs to cause the engine to compile a very large WebAssembly function body or a specially crafted function that uses many SSA values. The supplied severity vector indicates network reachability, low attack complexity, no user interaction, and that the attacker requires low privileges.

Are default Wasmtime configurations affected?

Yes. The advisory states that a Wasmtime engine with default settings, which uses the Cranelift backend, is susceptible.

Which versions contain a fix?

Wasmtime v36.0.19 fixes the issue. Wasmtime v43 also uses full u32 SSA value indices with checks when the limit is exceeded, removing susceptibility to this overflow.

GHSA-897f-g5gm-fmxm: Critical severity rust/wasmtime vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Are default Wasmtime configurations affected?

Which versions contain a fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Are default Wasmtime configurations affected?

Which versions contain a fix?