Ethical Hacking News
Two critical vulnerabilities have been discovered in the Wasmtime WebAssembly runtime, allowing malicious WebAssembly modules to potentially escape sandboxes. Wasmtime has released fixed versions to address these issues, and users and developers are advised to update to the latest versions to ensure the security of their applications and systems.
Two critical vulnerabilities, CVE-2026-115889 and CVE-2026-115893, have been discovered in Wasmtime WebAssembly runtime.CVE-2026-115889 affects all processor architectures, including x86 and ARM64, and can lead to type confusion and code execution.CVE-2026-115893 affects only ARM64 systems and is related to the br_table instruction.Risk of vulnerabilities is highest for services that compile modules written by others, such as Fastly's Compute platform.Fixed releases (36.0.19, 48.0.7, 49.0.4) are recommended to mitigate the risks, but no workarounds are provided.Users and developers must keep their applications and systems up to date and secure against these vulnerabilities.
Two critical vulnerabilities, CVE-2026-115889 and CVE-2026-115893, have been discovered in the Wasmtime WebAssembly runtime, a critical component of the WebAssembly ecosystem. According to the project's maintainers, these flaws could potentially allow a malicious WebAssembly module to escape the sandbox intended to contain it, compromising the security of applications that rely on Wasmtime.
The first flaw, CVE-2026-115889, affects all processor architectures, including x86 and ARM64. This vulnerability arises from how Cranelift, the compiler used by Wasmtime, stores numbers used to track values inside functions. In earlier versions of Wasmtime, these numbers were packed into 24-bit fields, which could overflow without error in certain cases. This, in turn, could lead to type confusion and the escape of the sandbox, allowing an attacker to execute arbitrary code. Fortunately, the maintainers of Wasmtime have already addressed this issue by widening the fields to 32 bits in version 43.0.0, which was released on March 20. However, the vulnerability was not fully resolved until version 36.0.19, which was released on October 19, 2026, and version 48.0.7, which was released on October 19, 2026, and version 49.0.4, which was released on October 20, 2026, and version 50.0.0, which was released on October 20, 2026.
The second flaw, CVE-2026-115893, affects only ARM64 systems, also known as aarch64. This vulnerability arises from the br_table instruction, which is used to jump to one of many places in the code based on an index. In this case, the issue arises when the jump table becomes too large for the branch to reach, causing the branch to silently point to the wrong place. This vulnerability has been present since Wasmtime first supported ARM64 in 2020, but its impact was not fully recognized until October 19, 2026. Fortunately, the maintainers of Wasmtime have addressed this issue by sending out-of-range indexes through the jump table itself, so no long branch is needed. They have also refused to compile a br_table with more than 65,520 targets.
The risk of these vulnerabilities is highest for services that compile modules written by other people, such as Fastly's Compute platform, which uses Wasmtime to run customer code. However, it is essential to note that neither advisory lists a workaround, and the risk comes from any module an outsider can supply. Therefore, hosts on an unsupported line need to move to one of the fixed releases, which are version 36.0.19, version 48.0.7, or version 49.0.4.
Wasmtime supports long-term support (LTS) releases, which are numbered in multiples of 12 for two years. The 36, 48, 49, and 50 release lines are still supported, and security fixes are guaranteed for these releases. However, other release lines, including the 24.x LTS line, which ended its support on August 20, 2026, do not receive security fixes.
In conclusion, the discovery of these two critical vulnerabilities in Wasmtime highlights the importance of keeping software up to date and following best practices for software development. The maintainers of Wasmtime have already addressed these issues, but it is crucial that users and developers take proactive steps to secure their applications and systems against these vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/Two-Critical-Flaws-in-Wasmtime-Runtime-Could-Allow-Malicious-WebAssembly-Modules-to-Escape-Sandboxes-ehn.shtml
https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html
https://nvd.nist.gov/vuln/detail/CVE-2026-115889
https://www.cvedetails.com/cve/CVE-2026-115889/
https://nvd.nist.gov/vuln/detail/CVE-2026-115893
https://www.cvedetails.com/cve/CVE-2026-115893/
Published: Mon Oct 26 12:42:15 2026 by llama3.2 3B Q4_K_M
