{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115893", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-23T19:37:27.177Z", "datePublished": "2026-10-23T21:29:33.917Z", "dateUpdated": "2026-10-23T21:29:33.917Z"}, "containers": {"cna": {"title": "Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "problemTypes": [{"descriptions": [{"cweId": "CWE-691", "lang": "en", "description": "CWE-691: Insufficient Control Flow Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"}, {"name": "https://github.com/bytecodealliance/wasmtime/pull/14818", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/pull/14818"}, {"name": "https://github.com/bytecodealliance/wasmtime/pull/14819", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/pull/14819"}, {"name": "https://github.com/bytecodealliance/wasmtime/pull/14820", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/pull/14820"}, {"name": "https://github.com/bytecodealliance/wasmtime/pull/14826", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/pull/14826"}, {"name": "https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"}, {"name": "https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"}, {"name": "https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"}, {"name": "https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}, {"name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"}, {"name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"}, {"name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"}], "affected": [{"vendor": "bytecodealliance", "product": "wasmtime", "versions": [{"version": "< 36.0.19", "status": "affected"}, {"version": ">= 37.0.0, < 48.0.7", "status": "affected"}, {"version": ">= 49.0.0, < 49.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-23T21:29:33.917Z"}, "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4."}], "source": {"advisory": "GHSA-mghf-wjfp-p5xm", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "wasmtime", "vendor": "bytecodealliance", "versions": [{"status": "affected", "version": "< 36.0.19"}, {"status": "affected", "version": ">= 37.0.0, < 48.0.7"}, {"status": "affected", "version": ">= 49.0.0, < 49.0.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4."}], "id": "CVE-2026-115893", "lastModified": "2026-10-23T22:16:58.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-10-23T22:16:58.820", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/pull/14818"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/pull/14819"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/pull/14820"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/pull/14826"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-691"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction", "id": "2560222", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560222"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.", "A flaw was found in Wasmtime. When compiling WebAssembly (Wasm) branch table instructions with an unusually large number of targets on 64-bit ARM (AArch64) systems, the Cranelift compiler backend generates an incorrect branch target. An attacker supplying a specially crafted WebAssembly module can exploit this vulnerability to redirect execution to arbitrary code offsets, allowing the module to escape the runtime sandbox and execute arbitrary code on the host system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-115893", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Affected", "package_name": "rhcl-1/wasm-shim-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "tree-sitter", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "virt-firmware-rs", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-23T21:29:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115893\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115893\nhttps://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd\nhttps://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618\nhttps://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe\nhttps://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa\nhttps://github.com/bytecodealliance/wasmtime/pull/14818\nhttps://github.com/bytecodealliance/wasmtime/pull/14819\nhttps://github.com/bytecodealliance/wasmtime/pull/14820\nhttps://github.com/bytecodealliance/wasmtime/pull/14826\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7\nhttps://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"], "statement": "Red Hat rates this vulnerability as Important because an attacker executing untrusted WebAssembly bytecode can bypass runtime sandbox restrictions and achieve arbitrary code execution in the context of the host process. The risk is constrained primarily to 64-bit ARM (aarch64) environments that evaluate untrusted or maliciously crafted modules containing unusually large multi-target branch tables. Deployments on other CPU architectures or those processing only verified, internal WebAssembly payloads are not exposed to this escape vector.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,36.0.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[37.0.0,48.0.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[49.0.0,49.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wasmtime", "source": "cna", "vendor": "bytecodealliance"}, "product": "wasmtime", "vendor": "bytecodealliance"}], "created": "2026-10-23T22:30:14.518752+00:00", "updated": "2026-10-29T13:30:08.333870+00:00", "vendors": ["bytecodealliance", "bytecodealliance$PRODUCT$wasmtime"]}