The Bytecode Alliance rated two WebAssembly runtime bugs at 9.9 out of 10 and shipped fixes on October 19 and 20. Both sit in Cranelift, the compiler Wasmtime uses by default, and both can be triggered by a module the attacker supplies.
CVE-2026-115889 is a bit-packing path in Cranelift that overflows silently and miscompiles the result, on any processor architecture. CVE-2026-115893 is narrower: on aarch64, a large br_table instruction can send execution to the wrong target. That one affects ARM64 hosts only.
Why the sandbox is the whole point
Wasmtime exists to run untrusted WebAssembly outside a browser while confining it to its own memory, to host functions it was explicitly granted, and to checked jump destinations. A miscompilation undermines that contract directly. The practical exposure therefore concentrates in platforms that compile code written by other people, including Fastly’s Compute service, which documents Wasmtime as its execution engine.
The advisories name no affected customers and do not describe what an escaped module could reach. Neither flaw has been added to CISA’s known-exploited list, and the maintainers report no attacks.
Patching is not just a version bump
Fixed releases are 36.0.19, 48.0.7, 49.0.4 and 50.0.0. Longer-term support follows a twelve-monthly numbering, and only lines 36, 48, 49 and 50 remain covered; older branches, including the retired 24.x long-term line, received nothing. Because Wasmtime is commonly linked into other software, updating a command-line tool is not enough, and each host application must be rebuilt. Note also that GitHub has a reviewed advisory entry only for the first CVE, so Dependabot will stay quiet about the ARM64 flaw.
