● Covered by 1 source · 1 reportMedium impact1 neutral
Critical Wasmtime Flaws Allow WebAssembly Sandbox Escapes, Affecting Multiple Versions
Key points
- Two critical flaws (CVSS 9.9) found in Wasmtime.
- Malicious WebAssembly modules can escape sandboxes.
- CVE-2026-115889 affects all architectures; CVE-2026-115893 affects ARM64.
- Fixed versions released October 19-20; no attacks reported.
Critical Sandbox Escape Vulnerabilities Identified
Wasmtime, a WebAssembly runtime used to execute WebAssembly code outside web browsers, has disclosed two critical vulnerabilities. These flaws could enable a malicious WebAssembly module to bypass the sandbox designed to contain it, potentially allowing unauthorized access or operations on the host system. Both bugs reside in Cranelift, Wasmtime's default compiler for converting WebAssembly into machine code.
Technical Details and Impact
The vulnerabilities are identified as CVE-2026-115889, which affects Wasmtime across all processor architectures, and CVE-2026-115893, which is specific to ARM64 (aarch64) systems. The project's maintainers at the Bytecode Alliance assigned a CVSS score of 9.9 out of 10 to each flaw. An attacker would need to compile a module they control using a vulnerable Wasmtime build to exploit these issues. The sandbox is intended to restrict modules to their own memory and specified host functions, preventing arbitrary code execution or jumps.
Affected Services and Risk Assessment
The risk posed by these vulnerabilities is highest for services that compile and run modules submitted by external parties. An example is Fastly's Compute platform, which uses Wasmtime to execute customer code. While the advisories do not name specific affected services or detail the extent of access an attacker could gain post-sandbox escape, the nature of the flaw suggests significant potential impact. As of October 26, neither flaw was listed in the U.S. CISA's Known Exploited Vulnerabilities catalog, and no attacks have been reported by the maintainers.
Patch Availability and Update Recommendations
Fixed versions of Wasmtime were released on October 19 and 20. Users are advised to update to the latest patched releases for their respective lines: 36.0.19, 48.0.7, or 49.0.4. Wasmtime 50.0.0, released on October 20, includes fixes for both vulnerabilities. Only Wasmtime's long-term support (LTS) releases (multiples of 12) and recent non-LTS releases are supported with security fixes. Users on unsupported versions, such as the 24.x LTS line, must migrate to a currently supported release to receive patches.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub bytecodealliance/wasmtime GitHub github/advisory-database GitHub en/code-security GitHub spinframework/spin CVE CVE-2026-1158899.9 CRITICAL CVE CVE-2026-1158939.9 CRITICALReporting from
Two critical vulnerabilities in Wasmtime, a WebAssembly runtime, could allow malicious WebAssembly modules to escape their intended sandboxes. These flaws, rated 9.9 on the CVSS scale, primarily affect services that compile untrusted user-provided modules. Fixed versions were released on October 19 and 20, and users are advised to update immediately.