External risk intelligence

Wasmtime Cranelift Compiler Value Index Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-115889

Wasmtime is a WebAssembly runtime library used by developers to embed execution environments into applications. While it can be part of internet-facing services that process untrusted Wasm code, it is primarily a component or library rather than a standalone edge service, appliance, or public-facing portal. Exposure depends entirely on how the consuming application implements and exposes the runtime.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Wasmtime, a runtime for WebAssembly code. The issue could allow for arbitrary miscompilation and potential escape from the Wasm sandbox under certain conditions, impacting systems that use this technology to run untrusted code. The main concern is confirming relevance and exposure within our environments.

A flaw exists in a WebAssembly runtime.
It could allow unauthorized code execution.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach this vulnerability by providing a specially crafted WebAssembly function to an application that uses the Wasmtime runtime with a specific compiler backend. If the function is complex enough, it can cause an internal compiler error during compilation in release builds. This miscompilation could then allow the attacker to execute code outside the intended WebAssembly sandbox, leading to significant system compromise.

Requires unauthenticated network access.
Triggered by compiling a malicious WebAssembly function.
Risk of sandbox escape and arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When Wasmtime's Cranelift compiler backend miscompiles WebAssembly code due to an integer overflow, it could lead to arbitrary miscompilation and type confusion. This may allow an attacker-controlled effect to escape the WebAssembly sandbox under certain conditions.

Wasmtime runtime, system code.
Malicious Wasm code triggers overflow.
Escapes sandbox, impacts system code.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Wasmtime, a WebAssembly runtime. Given its nature as a library, application owners integrating Wasmtime are primarily responsible for understanding and mitigating this risk. The first practical step is to identify all applications utilizing Wasmtime, determine their exposure to untrusted Wasm code, confirm business criticality, and then plan remediation.

Application owners should lead remediation efforts.
Verify Wasmtime usage and exposure to untrusted code.
Plan updates or vendor coordination for affected applications.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wasmtime and how is it used?

Wasmtime is an open-source runtime for WebAssembly, a portable binary format. Developers use it as a library to embed secure execution environments into their own software. This allows applications to run code that is isolated from the host system, often used for plugins, cloud-native services, or sandboxed scripting in larger programs.

How does this CVE-2026-115889 vulnerability work?

This issue involves Numeric Truncation Error (CWE-197) and Access of Uninitialized Pointer (CWE-843). When the Cranelift compiler backend encounters a large number of values, internal indices overflow. This bit-packing error causes the compiler to generate incorrect machine code, leading to type confusion and potential sandbox escapes where the code breaks out of its restricted environment.

What triggers this security flaw?

The flaw is triggered when Wasmtime compiles a specially crafted or highly complex WebAssembly function using the Cranelift backend in release mode. The vulnerability does not trigger if the runtime is using a different compiler configuration or if the input code is simple and does not force the specific bit-packing overflow in the compiler's internal logic.

Is my environment at risk for this issue?

According to Halo Surface Signal, risk depends on whether your application accepts and compiles untrusted WebAssembly code from external users. Because Wasmtime is a library, the vulnerability is not automatic; you must evaluate if your specific implementation exposes the Cranelift compiler to input from untrusted network sources.

Do I need to update my software immediately?

You should begin by identifying which of your applications utilize Wasmtime. Once identified, prioritize updating to version 36.0.19 or 43.0.0, which contain the fix. If immediate updates are not possible, assess the risk by verifying if the application allows untrusted users to supply the WebAssembly code being compiled.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.