CVE-2026-115893: critical Wasmtime flaw on aarch64

Wasmtime is a runtime for executing WebAssembly modules. CVE-2026-115893 affects versions prior to 36.0.19, 48.0.7, and 49.0.4: the Cranelift compiler backend has a flaw on aarch64 architecture whereby compiling a br_table instruction with more than approximately 256,000 targets can generate a conditional branch with an incorrect destination. A malicious WebAssembly module can hijack execution toward arbitrary code at a chosen offset, escaping the sandbox isolation.

CVE-2026-115893 is rated critical with a CVSS score of 9.9 according to NVD data, published on October 23, 2026. The data show no evidence of a publicly available exploit in repositories nor confirmed active exploitation in real-world environments. Limited social media discussion is recorded (3 posts in the last 24 hours, 16 total interactions): a growing but unverified attention signal, which does not constitute independent technical confirmation of severity or exploitation.

For CVE-2026-115893, IT teams running Wasmtime on aarch64 systems to execute untrusted WebAssembly modules should update immediately to the fixed versions (36.0.19, 48.0.7, or 49.0.4). It is advisable to check software inventories to identify which systems use Wasmtime and on what architecture, prioritizing aarch64 environments exposed to third-party or untrusted WebAssembly code, and to schedule the patch rollout as a high-priority action.