Two critical flaws in Wasmtime could let a malicious WebAssembly module escape its sandbox, potentially impacting services that compile and run untrusted modules.

Mitigation steps include updating to fixed releases (36.0.19, 48.0.7, 49.0.4, or 50.0.0) and rebuilding any program embedding Wasmtime with the fixed version; advisories do not list any workarounds.

CVEs are CVE-2026-115889 (affects all architectures) and CVE-2026-115893 (ARM64 only); advisories were issued by the Bytecode Alliance on October 19, with severity ratings around 9.9 out of 10 on the CVSS scale.

CVE-2026-115889 involves type confusion from 24-bit to larger values in Cranelift, enabling sandbox escape; CVE-2026-115893 involves br_table index handling on ARM64, where out-of-range indexes could jump to arbitrary code; fixes widen to 32-bit fields and ensure safe br_table handling with large targets.

Advisories did not name specific affected services, and CISA had not added these to the Known Exploited Vulnerabilities catalog as of late October.

Both flaws reside in Cranelift, the default compiler Wasmtime uses to translate WebAssembly to machine code; one flaw affects all architectures, the other specifically affects ARM64 (aarch64).

Fixes landed in Wasmtime 36.0.19, 48.0.7, 49.0.4, and 50.0.0, with older LTS lines like 24.x no longer supported; some lines (36, 48, 49, 50) remain supported.

Spin project has migrated to Wasmtime 50.0.0 in version 4.2.4 to align with the fix.

Impact depends on an attacker supplying a vulnerable module, with the highest risk for services that compile modules from third parties, such as Fastly's Compute platform.