CVE-2026-115893

The record

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Affected packages

Related vulnerabilities

• CVE-2025-51675 An issue was discovered in openRISC OR1200 commit 83ac6b. CWE-691
• CVE-2026-79033 Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65… CWE-691
• CVE-2026-20271 As part of Cisco's ongoing commitment to proactive security and product quality, the… CWE-691
• CVE-2026-5938 Improper control flow management allows a crafted document action chain to cause modal… CWE-691
• CVE-2025-35963 Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for… CWE-691
• CVE-2024-22374 Insufficient control flow management for some Intel(R) Xeon Processors may allow an… CWE-691