{"id":"GHSA-897f-g5gm-fmxm","revision":"033565308a9d435980ce4368476631ee","records":[{"revision":"033565308a9d435980ce4368476631ee","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-897f-g5gm-fmxm","aliases":["CVE-2026-115889","RUSTSEC-2026-0380"],"title":"Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","description":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` index, with checks if that limit is exceeded, and so is no longer susceptible to this bug.\n\n## Impact\n\nA Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module.\n\n## Patches\n\nWasmtime v36.0.19 has been released which fixes this issue.","state":0,"publishedAt":"2026-10-23T22:02:20+00:00","modifiedAt":"2026-10-23T22:25:51.5116598+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"36.0.19"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"37.0.0"},{"kind":"fixed","version":"43.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm","https://github.com/bytecodealliance/wasmtime/pull/12613","https://github.com/bytecodealliance/wasmtime/pull/14818","https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0","https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa","https://github.com/bytecodealliance/wasmtime","https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19","https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0","https://rustsec.org/advisories/RUSTSEC-2026-0380.html"],"sourceUrl":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-897f-g5gm-fmxm","identifiers":["GHSA-897f-g5gm-fmxm","CVE-2026-115889","RUSTSEC-2026-0380"]},"retained":false,"historicalAffected":[]}],"coverage":[]}