{"id":"GHSA-mghf-wjfp-p5xm","aliases":["CVE-2026-115893","RUSTSEC-2026-0379"],"title":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"## Summary\n\nWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one `br_table` instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes.\n\n## Impact\n\nAny Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected.\n\n## Patches\n\nWasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue.","severity":"critical","score":9.9,"published":"2026-10-23T21:29:33.917Z","modified":"2026-10-29T18:20:01.899Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"crates.io","name":"wasmtime","sources":[{"name":"OSV · GHSA-mghf-wjfp-p5xm","url":"https://osv.dev/vulnerability/GHSA-mghf-wjfp-p5xm"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"36.0.19"}],"type":"SEMVER"}],"versions":[],"fixed":["36.0.19"]},{"ecosystem":"crates.io","name":"wasmtime","sources":[{"name":"OSV · GHSA-mghf-wjfp-p5xm","url":"https://osv.dev/vulnerability/GHSA-mghf-wjfp-p5xm"}],"ranges":[{"events":[{"introduced":"37.0.0"},{"fixed":"48.0.7"}],"type":"SEMVER"}],"versions":[],"fixed":["48.0.7"]},{"ecosystem":"crates.io","name":"wasmtime","sources":[{"name":"OSV · GHSA-mghf-wjfp-p5xm","url":"https://osv.dev/vulnerability/GHSA-mghf-wjfp-p5xm"}],"ranges":[{"events":[{"introduced":"49.0.0"},{"fixed":"49.0.4"}],"type":"SEMVER"}],"versions":[],"fixed":["49.0.4"]}],"sourceAffected":[],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","https://nvd.nist.gov/vuln/detail/CVE-2026-115893","https://github.com/bytecodealliance/wasmtime/pull/14818","https://github.com/bytecodealliance/wasmtime/pull/14819","https://github.com/bytecodealliance/wasmtime/pull/14820","https://github.com/bytecodealliance/wasmtime/pull/14826","https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","https://rustsec.org/advisories/RUSTSEC-2026-0379.html"],"sources":[{"name":"OSV","id":"GHSA-mghf-wjfp-p5xm","modified":"2026-10-28T21:30:05.001444440Z","url":"https://osv.dev/vulnerability/GHSA-mghf-wjfp-p5xm"},{"name":"CVE","id":"CVE-2026-115893","modified":"2026-10-29T18:20:01.899Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115893"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9}],"cve":{"records":[{"id":"CVE-2026-115893","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-23T19:37:27.177Z","published":"2026-10-23T21:29:33.917Z","modified":"2026-10-29T18:20:01.899Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T21:29:33.917Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T18:20:01.899Z"}],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14818","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14826","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-691","description":"CWE-691: Insufficient Control Flow Management","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T18:19:46.559873Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"products":[{"vendor":"bytecodealliance","name":"wasmtime","platforms":[],"versions":[{"version":"< 36.0.19","status":"affected"},{"version":">= 37.0.0, < 48.0.7","status":"affected"},{"version":">= 49.0.0, < 49.0.4","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-115893"}],"remediation":[],"observedAt":"2026-10-29T18:49:49.221Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:25:31.829Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T22:35:31.473Z","attemptedAt":"2026-10-28T22:35:31.473Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T22:35:31.473Z","attemptedAt":"2026-10-28T22:35:31.473Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T22:35:31.473Z","attemptedAt":"2026-10-28T22:35:31.473Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T22:35:31.473Z","attemptedAt":"2026-10-28T22:35:31.473Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-115893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115893","modified":"2026-10-23T22:16:58.947","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-28T22:35:31.473Z"},{"source":"GitHub Advisory Database","id":"GHSA-mghf-wjfp-p5xm","url":"https://github.com/advisories/GHSA-mghf-wjfp-p5xm","modified":"2026-10-28T21:14:15Z","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-28T22:35:31.473Z"},{"source":"FIRST EPSS","id":"CVE-2026-115893","url":"https://www.first.org/epss/","probability":0.0099,"percentile":0.62391,"date":"2026-10-28","checkedAt":"2026-10-28T22:35:31.473Z"},{"source":"ENISA EUVD","id":"EUVD-2026-109188","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109188","modified":"Oct 28, 2026, 9:14:15 PM","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-28T22:35:31.473Z"}],"aiSummary":null}