{"id":"CVE-2026-115893","summary":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","details":"Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.","aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"modified":"2026-10-31T02:30:30.923792042Z","published":"2026-10-23T21:29:33.917Z","database_specific":{"cwe_ids":["CWE-691"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115893.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115893.json"},{"type":"ADVISORY","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"type":"FIX","url":"https://github.com/bytecodealliance/wasmtime/pull/14826"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bytecodealliance/wasmtime","events":[{"introduced":"0"},{"fixed":"0d6b8ead4e94b0ce76f925611b831b56570aef94"},{"introduced":"7b3d6ae79e9153a2477668062f5622c10333925f"},{"fixed":"c6846e13f64b07b7912d372db141397058b55f99"},{"introduced":"17830bd3c0331d920a8aa38846eebc4d46d98c23"},{"fixed":"2c2970205fe05d6bbf15b9bff6f1e67874b2db5c"},{"fixed":"222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"fixed":"994549891c8a706cb4f2809f9d17b9f67b31e618"},{"fixed":"e61df1b454be9313d61a5f8de07722a421139bbe"},{"fixed":"f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"36.0.19"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"37.0.0"},{"fixed":"48.0.7"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"49.0.0"},{"fixed":"49.0.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"222ff3a65dab9aa7011f8c246937751a0bac5abd"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"994549891c8a706cb4f2809f9d17b9f67b31e618"}]},{"range":[{"fixed":"e61df1b454be9313d61a5f8de07722a421139bbe"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v36.0.19","range":[{"fixed":"0d6b8ead4e94b0ce76f925611b831b56570aef94"}]},{"source":"REFERENCES_TAG","original_tag":"v48.0.7","range":[{"fixed":"c6846e13f64b07b7912d372db141397058b55f99"}]},{"source":"REFERENCES_TAG","original_tag":"v49.0.4","range":[{"fixed":"2c2970205fe05d6bbf15b9bff6f1e67874b2db5c"}]}]}}],"versions":["v36.0.18","v48.0.6","v49.0.3","v48.0.5","v36.0.17","v49.0.2","v48.0.4","v48.0.3","v49.0.1","v36.0.16","v49.0.0","v48.0.2","v36.0.15","v48.0.1","v36.0.14","v48.0.0","v36.0.13","v36.0.12","v36.0.11","v36.0.10","v36.0.9","v36.0.8","v36.0.7","v36.0.6","v36.0.5","dev","v36.0.4","v36.0.3","v36.0.2","v36.0.1","v36.0.0","v0.35.0","v0.33.0","v0.34.0","v0.32.0","v0.31.0","v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","cranelift-v0.69.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","cranelift-v0.61.0","cranelift-v0.60.0","v0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115893.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}