Security fix · CVE-2026-115889

Wasmtime is a runtime for WebAssembly.

Q: Which versions are affected?

Compare what you have installed with 26.0.1+dfsg-10, 26.0.1+dfsg-3, 26.0.1+dfsg-4, 0 → 36.0.19, 0.0.0-0 → 36.0.19, 37.0.0 → 43.0.0, = 37.0.0, < 43.0.0. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-197; CWE-843: Access of Resource Using Incompatible Type (Type Confusion). EPSS 0.45%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 19, 2026 · catalog updated Oct 24, 2026 · RustSec Rust

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115889. EPSS is 0.45%. Act only if a listed version of RustSec Rust is installed.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

CVE-2026-111959 · Medium
RUSTSEC-2026-0430 · Unknown
RUSTSEC-2026-0431 · Unknown
RUSTSEC-2026-0432 · Unknown
RUSTSEC-2026-0434 · Unknown

Severity: Critical9.9
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.45%
Remediation: Version ranges on file
Affected products: Debian:13 rust-wasmtime · Debian:14 rust-wasmtime · cargo wasmtime · crates.io wasmtime · package cargo · rust wasmtime

## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full index, with checks if that limit is exceeded, and so is no longer susceptible to this bug. ## Impact A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. ## Patches Wasmtime v36.0.19 has been released which fixes this issue.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

Debian:13 rust-wasmtime26.0.1+dfsg-10, 26.0.1+dfsg-3, 26.0.1+dfsg-4
Debian:14 rust-wasmtime26.0.1+dfsg-10, 26.0.1+dfsg-3, 26.0.1+dfsg-4
cargo wasmtimeversion unspecified
crates.io wasmtime0 → 36.0.19
crates.io wasmtime0.0.0-0 → 36.0.19
crates.io wasmtime37.0.0 → 43.0.0
package cargoversion unspecified
rust wasmtime< 36.0.19
rust wasmtime>= 37.0.0, < 43.0.0
vendor bytecodeallianceversion unspecified

How to fix CVE-2026-115889

Upgrade
CVE-2026-115889 lists a fix boundary at 36.0.19. Compare the installed build with that boundary before you change production.
Version check
Affected < 36.0.19
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115889. EPSS is 0.45%. Act only if a listed version of RustSec Rust is installed.

Which versions are affected?

Compare what you have installed with 26.0.1+dfsg-10, 26.0.1+dfsg-3, 26.0.1+dfsg-4, 0 → 36.0.19, 0.0.0-0 → 36.0.19, 37.0.0 → 43.0.0, < 36.0.19, >= 37.0.0, < 43.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-197; CWE-843: Access of Resource Using Incompatible Type (Type Confusion). EPSS 0.45%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 23, 2026 · EUVD
Detected
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other att
Oct 23, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19; wasmtime fixed in 43.0.0
Oct 23, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19
Oct 23, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 43.0.0
Oct 23, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19
Oct 23, 2026 · GitHub Advisory Database
Updated
## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary s
Oct 24, 2026 · OpenSSF OSV / OSV Scanner
Updated
## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary s

Sources

CVE.orgVulnerability recordCVE-2026-115889
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-115889
30-day exploitation probability 0.45%
first.org
EUVDVulnerability recordEUVD-2026-109186
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The ov
euvd.enisa.europa.eu
GitHub Advisory DatabasePackage advisoryGHSA-897f-g5gm-fmxm
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-115889
In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects
advisories.gitlab.com
OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-115889
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-897f-g5gm-fmxm
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryRUSTSEC-2026-0380
Bit-packing in Cranelift compiler causes silent overflow and miscompilation
osv.dev
RustSec Advisory DBVendor advisoryCVE-2026-115889
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm For more information see the GitHub-hosted security advisory. (RUSTSEC-2026-0380)
crates.io
Snyk Vulnerability DatabasePackage advisorySNYK-RUST-WASMTIME-21708541
Numeric Truncation Error
security.snyk.io

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSNov 6, 2026
GitLab Advisory DatabaseOct 27, 2026
RustSec Advisory DBOct 27, 2026
Snyk Vulnerability DatabaseOct 27, 2026
CVE.orgOct 24, 2026
GitHub Advisory DatabaseOct 24, 2026
OpenSSF OSV / OSV ScannerOct 24, 2026
OpenSSF OSV / OSV ScannerOct 24, 2026
OpenSSF OSV / OSV ScannerOct 24, 2026
EUVDOct 23, 2026

Priority score

27/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity15/15
Public exploit0/10
Internet exposure6/10
Product prevalence5/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.9 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS probability
0.45% · p39.13%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Debian Debian 13 Debian 14 Linux Rust

Weakness

CWE-197 MITRE definition
CWE-843
Access of Resource Using Incompatible Type (Type Confusion)
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.