Wasmtime: Silent overflow and miscompilation in Cranelift compiler

Summary

Wasmtime's Cranelift compiler backend can silently overflow its SSA value index bit-packing when compiling a very large or specially crafted WebAssembly function in release builds. This can lead to miscompiled code, type confusion and other attacker-controlled effects that may escape the WebAssembly sandbox. The attacker needs low-privilege access, such as the ability to submit a Wasm module, and the flaw affects the default Cranelift backend on any architecture.

Affected

• Wasmtime versions before 36.0.19
• Wasmtime versions 37.0.0 up to but not including 43.0.0

Fixed in

• Upgrade to 36.0.19 (36.x line)
• Upgrade to 43.0.0 or later (43.x line and newer)

Workaround

Unknown. No vendor-documented workaround is available. Upgrading is the vendor's stated solution.

Exploitation

• CISA SSVC assessment on the CVE record: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV at the time of research
• No public proof of concept and no known exploitation in the wild as of October 24, 2026 (third-party source)

Our recommendation

• Identify all systems running Wasmtime directly or through embedded products, for example plugin runtimes
• Upgrade to 36.0.19 or 43.0.0 or later; note that 37.x through 42.x are affected
• Prioritise internet-facing services that accept untrusted or user-supplied Wasm modules
• Check vendor and product advisories for updated dependencies and monitor KEV and the GitHub advisory for changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  ideator-labs/wasmtime-sweep

Research sources

• GitHub Security Advisory GHSA-897f-g5gm-fmxm github.com
• GitHub Advisory Database GHSA-897f-g5gm-fmxm github.com
• Wasmtime release 36.0.19 github.com
• Wasmtime release 43.0.0 github.com
• Wasmtime commit ba8f7d7 (ValueDataPacked fix) github.com
• RustSec RUSTSEC-2026-0380 rustsec.org
• GitLab Advisory Database CVE-2026-115889 advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:55.