Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Impact
Wasmtime versions before 36.0.19 and 43.0.0 have a bit-packing issue in the Cranelift compiler, causing silent overflows and miscompilation. This can lead to type confusion and other attacker-controlled effects. The issue is fixed in versions 36.0.19 and 43.0.0.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
bytecodealliance · GitHub_M
wasmtime
2 ranges
bytecodealliance · GitHub_M
wasmtime
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 36.0.19
>= 37.0.0, < 43.0.0
Other versions: unknown
Original source description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115889View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.