Silent overflow in Wasmtime Cranelift compiler causes miscompilation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-843 and the CVSS impact.
Summary
Wasmtime versions before 36.0.19 and from 37.0.0 before 43.0.0 are affected. The Cranelift compiler bit-packs SSA value indices, and this packing can silently overflow in release builds when it compiles a large or crafted WebAssembly function (CWE-197). The overflow makes Cranelift reference wrong IR values, so an attacker who supplies a crafted Wasm module with low privileges can cause miscompilation that may escape the Wasm sandbox.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bytecodealliance | wasmtime | before 36.0.19; 37.0.0 to before 43.0.0 | 36.0.19, 43.0.0 | Patch available | CNA |
| — | wasmtime (crates.io) | before 36.0.19 | 36.0.19 | Patch available | GHSA-897f-g5gm-fmxm |
| — | wasmtime (crates.io) | 37.0.0 to before 43.0.0 | 43.0.0 | Patch available | GHSA-897f-g5gm-fmxm |
- wasmtime Vendorbytecodealliance Affected before 36.0.19; 37.0.0 to before 43.0.0 Fixed in 36.0.19, 43.0.0 Patch available CNA
- wasmtime (crates.io) Vendor— Affected before 36.0.19 Fixed in 36.0.19 Patch available GHSA-897f-g5gm-fmxm
- wasmtime (crates.io) Vendor— Affected 37.0.0 to before 43.0.0 Fixed in 43.0.0 Patch available GHSA-897f-g5gm-fmxm
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* | — | — | bytecodealliance |
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance
Remediation
Upgrade the wasmtime crate to 36.0.19 on the 36 line or to 43.0.0 on the 37 and later line. Red Hat has no fix plan available for Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.19, 43.0.0
- Fix · GHSA-897f-g5gm-fmxm wasmtime (crates.io) Fixed in 36.0.19 Advisory →
- Fix · GHSA-897f-g5gm-fmxm wasmtime (crates.io) Fixed in 43.0.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115889
- 2026-10-23 Alias added: GHSA-897f-g5gm-fmxm
- 2026-10-23 Fix available: crates.io/[email protected], crates.io/[email protected] · GHSA-897f-g5gm-fmxm
- 2026-10-23 CVSS score added · GHSA-897f-g5gm-fmxm
- 2026-10-23 Weakness changed · GHSA-897f-g5gm-fmxm
- 2026-10-23 9 new references · GHSA-897f-g5gm-fmxm
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Other 9
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
- https://github.com/bytecodealliance/wasmtime/pull/12613
- https://github.com/bytecodealliance/wasmtime/pull/14818
- https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
- https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
- https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
- https://github.com/bytecodealliance/wasmtime
- https://rustsec.org/advisories/RUSTSEC-2026-0380.html
More bytecodealliance vulnerabilities
- TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
- TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
- TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
- TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
- TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
- TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-115889 · CVE Program
- CVE-2026-115889 · NVD
- FIRST EPSS
- GHSA-897f-g5gm-fmxm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences