CVE-2026-115893
Critical
Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
SeverityCritical
CVSS9.9
Exploit probability—
Product
Wasmtime
PublishedOct 23, 2026
First seenOct 23, 2026
Weakness typeCWE-691CWE-691
How to fix
Update
- wasmtime36.0.19, 48.0.7, 49.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wasmtimecrates.io | v < 36.0.19, 37.0.0 ≤ v < 48.0.7, 49.0.0 ≤ v < 49.0.4 | 36.0.19, 48.0.7, 49.0.4 |
| microsoft azl3_rust_1.96.1-2 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.