Quick answers
- Is CVE-2026-115889 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115889 being exploited in the wild.
- How severe is CVE-2026-115889?
- Critical severity, with a CVSS score of 9.9, published 23 October 2026.
- Which products and versions are affected?
- Bytecode Alliance Wasmtime < 36.0.19 and >= 37.0.0, < 43.0.0, prior to 36.0.19 and prior to 43.0.0; wasmtime (crates.io) < 36.0.19, SEMVER:introduced=0,fixed=36.0.19.
- Is there a fix for CVE-2026-115889?
- Yes. wasmtime (crates.io): upgrade to 36.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115889 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-115889?
- Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- wasmtime (crates.io): upgrade to 36.0.19 or later
cargo update -p wasmtime
Technical details
The Cranelift compiler backend bit-packs SSA value indices into a narrower integer type, causing silent overflow in release builds when a Wasm function uses many SSA values. This results in incorrect value references in the intermediate representation, enabling type confusion and arbitrary miscompilation. The vulnerability requires no privileges and can be triggered remotely by submitting a specially-crafted Wasm module to a Wasmtime engine using default settings.
Affected products
- Bytecode Alliance Wasmtime < 36.0.19 and >= 37.0.0, < 43.0.0
Identifiers
- CVE-2026-115889
- GHSA-897f-g5gm-fmxm
- RUSTSEC-2026-0380
Timeline
- 2026-10-19: disclosed
- 2026-10-23: advisory
- 2026-10-19: patched: v36.0.19 and v43.0.0 released