CVE-2026-115889
CVE-2026-115889 is a critical-severity vulnerability with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-197.
Key facts
- Severity: Critical (CVSS 3.x base score 9.9)
- EPSS exploit prediction: 1% (51st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-197
- Published:
- Last modified:
Description
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
Frequently asked questions
- What is CVE-2026-115889?
- Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
- How severe is CVE-2026-115889?
- CVE-2026-115889 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2026-115889 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-115889?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2026-115889 published?
- CVE-2026-115889 was published on 2026-10-23.
References
- https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0
- https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa
- https://github.com/bytecodealliance/wasmtime/pull/12613
- https://github.com/bytecodealliance/wasmtime/pull/14818
- https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19
- https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
Other CWE-197 vulnerabilities
- CVE-2024-43639 — Critical (CVSS 9.8): Windows KDC Proxy Remote Code Execution Vulnerability
- CVE-2026-87529 — Critical (CVSS 9.6): Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially…
- CVE-2020-15202 — Critical (CVSS 9.0): In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last…
- CVE-2024-49018 — High (CVSS 8.8): SQL Server Native Client Remote Code Execution Vulnerability
- CVE-2024-43519 — High (CVSS 8.8): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
- CVE-2024-30009 — High (CVSS 8.8): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability