CVE-2026-115889: Sandbox Escape in Wasmtime

CVE-2026-115889 affects Wasmtime, a runtime for secure WebAssembly execution in untrusted environments. The Cranelift backend compiler contains a flaw in bit-packing SSA value indices: in release mode, silent overflow during compilation of large or specially crafted WebAssembly functions causes miscompilation, type confusion, and attacker-controlled effects. The most severe consequence is bypassing the WebAssembly sandbox on any architecture using the Cranelift backend by default.

The CVSS is 9.9 (Critical). The vulnerability was officially disclosed on October 23, 2026; patches are immediately available in versions 36.0.19 and 43.0.0. As of October 29, 2026, an offline detector has been reported publicly available on GitHub to detect Wasmtime version exposure. The absence of public signals on social media does not reduce urgency: a flaw that allows sandbox escape in a code execution runtime remains always critical for supply chain security.

IT teams and CISOs must immediately inventory all Wasmtime instances in enterprise environments—containers, serverless platforms, applications executing WebAssembly. Apply updates to 36.0.19 or 43.0.0+ through official channels as quickly as possible. Monitor systems running Wasm code for anomalous activity. If available, review Cranelift compiler logs. Speed between disclosure and patch application is the advantage still available to defenders.