CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115893?
CVE-2026-115893 is a critical vulnerability in bytecodealliance wasmtime, published on 23 Oct 2026.
Official description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
Weakness: CWE-691
Which versions are affected by CVE-2026-115893?
7 open source packages ship an affected version, including wasmtime.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | All versions | 36.0.19 |
wasmtime crates.io | All versions | 36.0.19 |
wasmtime crates.io | From 0.0.0-0 | 36.0.19, 48.0.7, 49.0.4 |
wasmtime crates.io | From 37.0.0 | 48.0.7 |
wasmtime crates.io | From 37.0.0 | 48.0.7 |
wasmtime crates.io | From 49.0.0 | 49.0.4 |
1 more packages
wasmtime crates.io | From 49.0.0 | 49.0.4 |
How do I fix CVE-2026-115893?
Upgrade wasmtime to a fixed version for your release line: 36.0.19, 48.0.7 or 49.0.4.
Is CVE-2026-115893 being exploited?
There is no known exploitation of CVE-2026-115893 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-111428, AZL-111434, DEBIAN-CVE-2026-115893, GHSA-mghf-wjfp-p5xm, RUSTSEC-2026-0379, UBUNTU-CVE-2026-115893.