Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-115889
Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks if that limit is exceeded, and so is no longer susceptible to this bug. Impact A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. Patches Wasmtime v36.0.19 has been released which fixes this issue.
Proof-of-concept code is published
Public PoC
- Public PoCideator-labs/wasmtime-sweep
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 9.9 (v3.1)
- Severity
- Critical
- EPSS
- 0.00454% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- rust · wasmtime
- Weakness
- CWE-197, CWE-843
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
At the source
References
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
- https://github.com/bytecodealliance/wasmtime/pull/12613
- https://github.com/bytecodealliance/wasmtime/pull/14818
- https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
- https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
- https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
- https://rustsec.org/advisories/RUSTSEC-2026-0380.html
- https://github.com/advisories/GHSA-897f-g5gm-fmxm
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-115889