Wasmtime Patches Critical Sandbox Escape Flaws

Two critical flaws in Wasmtime could allow malicious WebAssembly modules to escape their intended sandboxes. Both bugs are located in Cranelift, the compiler Wasmtime uses by default. An attacker must have a vulnerable Wasmtime build to compile a controlled module to exploit these flaws. Wasmtime maintainers rated each flaw 9.9 out of 10 on the CVSS scale and have not reported any attacks exploiting them.

CVE-2026-115889 affects Wasmtime across all processor architectures, while CVE-2026-115893 affects only ARM64 systems. Fixed versions were released on October 19 and October 20. Wasmtime 50.0.0, released on October 20, is fixed for both flaws. Only release lines 36, 48, 49, and 50 are still supported. ARM64 hosts updated to specific versions in April remain affected by CVE-2026-115893.

Updating the command-line tool does not fix programs built with Wasmtime; each program must be rebuilt. Neither advisory lists a workaround. Spin moved to Wasmtime 50.0.0 in version 4.2.4 on October 21. Neither flaw was listed in the CISA Known Exploited Vulnerabilities catalog as of October 26.