# CVE-2026-115889: Wasmtime Cranelift SSA value index overflow

Source: https://junglewise.ai/threats/cve-2026-115889-wasmtime-is-a-runtime-for-webassembly-prior-to-36-0-19-and-43-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115889 · Severity: critical · CVSS 9.9 · Published 2026-10-23

Wasmtime is a WebAssembly runtime that executes untrusted code in a sandboxed environment. A flaw in the Cranelift compiler backend's handling of internal value indices can cause integer overflow, leading to type confusion and arbitrary code execution that breaks out of the sandbox. An attacker can craft a malicious WebAssembly module to exploit this and gain unrestricted access to the host system.

Technologies: [Bytecode Alliance Wasmtime](https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime), [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime). Vendors: [Bytecode Alliance](https://junglewise.ai/threats/vendors/bytecode-alliance), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-115889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115889 being exploited in the wild.

**How severe is CVE-2026-115889?** Critical severity, with a CVSS score of 9.9, published 23 October 2026.

**Which products and versions are affected?** Bytecode Alliance Wasmtime < 36.0.19 and >= 37.0.0, < 43.0.0, prior to 36.0.19 and prior to 43.0.0; wasmtime (crates.io) < 36.0.19, SEMVER:introduced=0,fixed=36.0.19.

**Is there a fix for CVE-2026-115889?** Yes. wasmtime (crates.io): upgrade to 36.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115889?** Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wasmtime (crates.io): upgrade to 36.0.19 or later

  ```sh
  cargo update -p wasmtime
  ```


## Technical details

The Cranelift compiler backend bit-packs SSA value indices into a narrower integer type, causing silent overflow in release builds when a Wasm function uses many SSA values. This results in incorrect value references in the intermediate representation, enabling type confusion and arbitrary miscompilation. The vulnerability requires no privileges and can be triggered remotely by submitting a specially-crafted Wasm module to a Wasmtime engine using default settings.

## Affected products

- Bytecode Alliance Wasmtime < 36.0.19 and >= 37.0.0, < 43.0.0

## Identifiers

- CVE-2026-115889
- GHSA-897f-g5gm-fmxm
- RUSTSEC-2026-0380

## Timeline

- 2026-10-19: disclosed
- 2026-10-23: advisory
- 2026-10-19: patched: v36.0.19 and v43.0.0 released

## References

- [https://api.github.com/users/jaydns](https://api.github.com/users/jaydns)

## Related threats

- [Wasmtime wasi-http response splitting via unvalidated headers](https://junglewise.ai/threats/cve-2026-121439-wasmtime-46-0-0-before-48-0-7-and-49-0-0-before-49-0-4-contains)
- [Wasmtime denial of service in component model stream operations](https://junglewise.ai/threats/cve-2026-119143-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime host panic in call_async Future drop](https://junglewise.ai/threats/cve-2026-119142-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime denial of service in realloc handling](https://junglewise.ai/threats/cve-2026-119141-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime denial of service via thread.yield in component start](https://junglewise.ai/threats/cve-2026-119140-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)