Read the docs
TI-2026-80003 Aliases CVE-2026-115893GHSA-mghf-wjfp-p5xm

Cranelift on aarch64 jumps to wrong target in large Wasmtime br_table

Priority MEDIUM 45CWE-691Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Wasmtime before 36.0.19, from 37.0.0 before 48.0.7, and from 49.0.0 before 49.0.4 is affected. The Cranelift backend on aarch64 compiles a Wasm br_table instruction with more than approximately 256,000 targets with an incorrect conditional branch target (CWE-691). A user-controlled Wasm module can make the branch jump to arbitrary code at a user-controlled offset and escape the sandbox on aarch64 engines using the default Cranelift backend.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0099 62nd percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 36.0.19, 48.0.7, 49.0.4wasmtime (crates.io): 36.0.19, 48.0.7, 49.0.4Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtimebefore 36.0.19; 37.0.0 to before 48.0.7; 49.0.0 to before 49.0.436.0.19, 48.0.7, 49.0.4Patch availableCNA
—wasmtime (crates.io)before 36.0.1936.0.19Patch availableGHSA-mghf-wjfp-p5xm
—wasmtime (crates.io)37.0.0 to before 48.0.748.0.7Patch availableGHSA-mghf-wjfp-p5xm
—wasmtime (crates.io)49.0.0 to before 49.0.449.0.4Patch availableGHSA-mghf-wjfp-p5xm
  • wasmtime Vendorbytecodealliance Affected before 36.0.19; 37.0.0 to before 48.0.7; 49.0.0 to before 49.0.4 Fixed in 36.0.19, 48.0.7, 49.0.4 Patch available CNA
  • wasmtime (crates.io) Vendor— Affected before 36.0.19 Fixed in 36.0.19 Patch available GHSA-mghf-wjfp-p5xm
  • wasmtime (crates.io) Vendor— Affected 37.0.0 to before 48.0.7 Fixed in 48.0.7 Patch available GHSA-mghf-wjfp-p5xm
  • wasmtime (crates.io) Vendor— Affected 49.0.0 to before 49.0.4 Fixed in 49.0.4 Patch available GHSA-mghf-wjfp-p5xm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*——bytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Upgrade the wasmtime crate to 36.0.19, 48.0.7, or 49.0.4, matching your release line. The sources list no fixed version for Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.19, 48.0.7, 49.0.4
  • Fix · GHSA-mghf-wjfp-p5xm wasmtime (crates.io) Fixed in 36.0.19 Advisory →
  • Fix · GHSA-mghf-wjfp-p5xm wasmtime (crates.io) Fixed in 48.0.7 Advisory →
  • Fix · GHSA-mghf-wjfp-p5xm wasmtime (crates.io) Fixed in 49.0.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-115893
  2. 2026-10-25 EPSS moved to the below the 50th percentile
  3. 2026-10-28 EPSS moved to the 50th–90th percentile
  4. 2026-10-28 Alias added: GHSA-mghf-wjfp-p5xm
  5. 2026-10-28 Fix available: crates.io/[email protected], crates.io/[email protected], crates.io/[email protected] · GHSA-mghf-wjfp-p5xm
  6. 2026-10-28 CVSS score added · GHSA-mghf-wjfp-p5xm
  7. 2026-10-28 Weakness changed · GHSA-mghf-wjfp-p5xm
  8. 2026-10-28 15 new references · GHSA-mghf-wjfp-p5xm
  9. 2026-10-29 Affected versions changed · Red Hat
  10. 2026-10-29 CVSS score added · Red Hat
  11. 2026-10-29 CISA SSVC decision points changed
  12. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

Other 14

  • TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences