{"id":"AZL-111437","summary":"CVE-2026-115889 affecting package rust 1.96.1-2","details":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.","modified":"2026-10-30T05:35:37Z","published":"2026-10-23T22:16:58Z","upstream":["CVE-2026-115889"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115889"}],"affected":[{"package":{"name":"rust","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rust"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.96.1-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111437.json"}}],"schema_version":"1.9.2"}