Quick answers
- Is CVE-2026-115893 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115893 being exploited in the wild.
- How severe is CVE-2026-115893?
- Critical severity, with a CVSS score of 9.9, published 23 October 2026.
- Which products and versions are affected?
- Bytecode Alliance Wasmtime before 36.0.19, 48.0.7, and 49.0.4; wasmtime (crates.io) < 36.0.19, SEMVER:introduced=0,fixed=36.0.19.
- Is there a fix for CVE-2026-115893?
- Yes. wasmtime (crates.io): upgrade to 36.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115893 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-115893?
- Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- wasmtime (crates.io): upgrade to 36.0.19 or later
cargo update -p wasmtime
Technical details
The Cranelift compiler backend on aarch64 incorrectly compiles WebAssembly br_table instructions with over approximately 256,000 targets, resulting in an out-of-bounds branch offset that wraps and jumps to an attacker-specified memory location. The vulnerability stems from a conditional branch with a ±1 MiB range being used for the default case when the table offset exceeds available space. An attacker with control over a Wasm module can trigger this to escape the sandbox.
Affected products
- Bytecode Alliance Wasmtime before 36.0.19, 48.0.7, and 49.0.4
Identifiers
- CVE-2026-115893
- GHSA-mghf-wjfp-p5xm
- RUSTSEC-2026-0379
Timeline
- 2026-10-23: disclosed
- 2026-10-19: patched