Security fix · CVE-2026-115893

Wasmtime is a runtime for WebAssembly.

Q: Which versions are affected?

Compare what you have installed with 0 → 36.0.19, 0.0.0-0 → 36.0.19, 37.0.0 → 48.0.7, 49.0.0 → 49.0.4, = 37.0.0, < 48.0.7. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-691. EPSS 0.99%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 19, 2026 · catalog updated Oct 28, 2026 · Rust

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115893. EPSS is 0.99%. Act only if a listed version of Rust is installed.

Gaps on this record

No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

RUSTSEC-2026-0455 · Unknown
RUSTSEC-2026-0447 · Unknown
RUSTSEC-2026-0443 · Unknown
RUSTSEC-2026-0445 · Unknown
RUSTSEC-2026-0446 · Unknown

Severity: Critical9.9
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.99%
Remediation: Version ranges on file
Affected products: crates.io wasmtime · package cargo · rust wasmtime · vendor bytecodealliance

## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. ## Impact Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. ## Patches Wasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

crates.io wasmtime0 → 36.0.19
crates.io wasmtime0.0.0-0 → 36.0.19
crates.io wasmtime37.0.0 → 48.0.7
crates.io wasmtime49.0.0 → 49.0.4
package cargoversion unspecified
rust wasmtime< 36.0.19
rust wasmtime>= 37.0.0, < 48.0.7
rust wasmtime>= 49.0.0, < 49.0.4
vendor bytecodeallianceversion unspecified

How to fix CVE-2026-115893

Upgrade
CVE-2026-115893 lists a fix boundary at 36.0.19. Compare the installed build with that boundary before you change production.
Version check
Affected < 36.0.19
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115893. EPSS is 0.99%. Act only if a listed version of Rust is installed.

Which versions are affected?

Compare what you have installed with 0 → 36.0.19, 0.0.0-0 → 36.0.19, 37.0.0 → 48.0.7, 49.0.0 → 49.0.4, < 36.0.19, >= 37.0.0, < 48.0.7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-691. EPSS 0.99%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 23, 2026 · EUVD
Detected
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on
Oct 24, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19
Oct 24, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19
Oct 24, 2026 · GitHub Advisory Database
Updated
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory.
Oct 28, 2026 · EUVD
Updated
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm instruction
Oct 28, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 36.0.19; wasmtime fixed in 48.0.7; wasmtime fixed in 49.0.4
Oct 28, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 48.0.7
Oct 28, 2026 · GitHub Advisory Database
Fix available
wasmtime fixed in 49.0.4
Oct 28, 2026 · GitHub Advisory Database
Updated
## Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. ## Impact Any Wasmtime engine runnin

Sources

CVE.orgVulnerability recordCVE-2026-115893
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-115893
30-day exploitation probability 0.99%
first.org
EUVDVulnerability recordEUVD-2026-109188
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm instruction
euvd.enisa.europa.eu
GitHub Advisory DatabasePackage advisoryGHSA-mghf-wjfp-p5xm
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm instruction
github.com
OpenSSF OSV / OSV ScannerPackage advisoryGHSA-mghf-wjfp-p5xm
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm instruction
osv.dev
OpenSSF OSV / OSV ScannerPackage advisoryRUSTSEC-2026-0379
Cranelift backend on aarch64 can jump to incorrect target on large Wasm instruction
osv.dev
RustSec Advisory DBVendor advisoryCVE-2026-115893
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory. (RUSTSEC-2026-0379)
crates.io
Snyk Vulnerability DatabasePackage advisorySNYK-RUST-WASMTIME-21708542
Insufficient Control Flow Management
security.snyk.io

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSNov 6, 2026
GitHub Advisory DatabaseOct 29, 2026
OpenSSF OSV / OSV ScannerOct 29, 2026
EUVDOct 29, 2026
RustSec Advisory DBOct 27, 2026
Snyk Vulnerability DatabaseOct 27, 2026
OpenSSF OSV / OSV ScannerOct 26, 2026
CVE.orgOct 24, 2026

Priority score

16/100

Evidence confidence: High

A vendor or government advisory agrees with at least one other source.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity15/15
Public exploit0/10
Internet exposure0/10
Product prevalence0/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.9 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS probability
0.99% · p62.39%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

Rust

Weakness

CWE-691 MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.