{"id":"GHSA-mghf-wjfp-p5xm","summary":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","details":"## Summary\n\nWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one `br_table` instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes.\n\n## Impact\n\nAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected.\n\n## Patches\n\nWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.","aliases":["CVE-2026-115893","RUSTSEC-2026-0379"],"modified":"2026-10-28T21:30:05.001444440Z","published":"2026-10-28T21:14:14Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-28T21:14:14Z","nvd_published_at":"2026-10-23T22:16:58Z","cwe_ids":["CWE-691"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14818"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/pull/14826"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"},{"type":"PACKAGE","url":"https://github.com/bytecodealliance/wasmtime"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"type":"WEB","url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0379.html"}],"affected":[{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"36.0.19"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mghf-wjfp-p5xm/GHSA-mghf-wjfp-p5xm.json"}},{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"37.0.0"},{"fixed":"48.0.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mghf-wjfp-p5xm/GHSA-mghf-wjfp-p5xm.json"}},{"package":{"name":"wasmtime","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime"},"ranges":[{"type":"SEMVER","events":[{"introduced":"49.0.0"},{"fixed":"49.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mghf-wjfp-p5xm/GHSA-mghf-wjfp-p5xm.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}