CVE-2026-115889

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

• CWE-197
• CWE-843

• https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
• https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
• https://github.com/bytecodealliance/wasmtime/pull/12613
• https://github.com/bytecodealliance/wasmtime/pull/14818
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
• https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115877Twisted is an event-based framework for internet application…5.4
• CVE-2026-11588The EONSR AEO Agent WordPress plugin through 3.7.9 does not …6.1
• CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-bac…6
• CVE-2026-115885The LangGraph CLI is the official command-line interface for…4.1
• CVE-2026-115886MLflow is an open source AI engineering platform for agents,…6.5
• CVE-2026-115887GraphQL Scalars is a library of custom GraphQL scalars for c…7.5
• CVE-2026-11589The WP Support Plus Responsive Ticket System WordPress plugi…8.8
• CVE-2026-115892Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.…5.7
• CVE-2026-115893Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.…9.9
• CVE-2026-115895Happy DOM is a JavaScript implementation of a web browser wi…8.8
• CVE-2026-115897Serialize JavaScript serializes JavaScript values to a super…2.1
• CVE-2026-1159A weakness has been identified in itsourcecode Online Frozen…9.8