CVE-2026-115889

The record

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

Affected packages

Related vulnerabilities

• CVE-2026-116742 HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in… CWE-197
• CVE-2026-116012 Ghidra before 12.2 contains a numeric truncation vulnerability in… CWE-197
• CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authorized… CWE-197
• CVE-2026-70123 Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to… CWE-197
• CVE-2026-96280 The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and… CWE-197
• CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is… CWE-197
• CVE-2026-87529 Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a… CWE-197
• CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate… CWE-197