{"id":"CVE-2026-115889","summary":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","details":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.","aliases":["GHSA-897f-g5gm-fmxm","RUSTSEC-2026-0380"],"modified":"2026-10-25T02:45:48.060772290Z","published":"2026-10-23T21:23:27.669Z","database_specific":{"cwe_ids":["CWE-197","CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115889.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115889.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115889"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/12613"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14818"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bytecodealliance/wasmtime","events":[{"introduced":"0"},{"fixed":"0d6b8ead4e94b0ce76f925611b831b56570aef94"},{"introduced":"7b3d6ae79e9153a2477668062f5622c10333925f"},{"fixed":"be23469ece57c0be64904f12111c8d808b0ce4ac"},{"fixed":"ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0"},{"fixed":"f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"36.0.19"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"37.0.0"},{"fixed":"43.0.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0"}]},{"range":[{"fixed":"f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v36.0.19","range":[{"fixed":"0d6b8ead4e94b0ce76f925611b831b56570aef94"}],"source":"REFERENCES_TAG"},{"original_tag":"v43.0.0","range":[{"fixed":"be23469ece57c0be64904f12111c8d808b0ce4ac"}],"source":"REFERENCES_TAG"}]}}],"versions":["v36.0.18","v36.0.17","v36.0.16","v36.0.15","v36.0.14","v36.0.13","v36.0.12","v36.0.11","v36.0.10","v36.0.9","v36.0.8","v36.0.7","v36.0.6","v36.0.5","dev","v36.0.4","v36.0.3","v36.0.2","v36.0.1","v36.0.0","v0.35.0","v0.33.0","v0.34.0","v0.32.0","v0.31.0","v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","cranelift-v0.69.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","cranelift-v0.61.0","cranelift-v0.60.0","v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115889.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}