Two Critical Wasmtime Flaws Allow Sandbox Escape

If anything you run is built on Wasmtime, it's time to check your version. Two critical bugs in the WebAssembly runtime can let a malicious module break out of the sandbox meant to hold it. The Hacker News flagged it on X today, though fixes have been out for about a week.

What happened

The Bytecode Alliance, which maintains Wasmtime, published two advisories on October 19 and rated both flaws 9.9 out of 10. Both are in Cranelift, the compiler Wasmtime uses by default to turn WebAssembly into machine code.

• CVE-2026-115889 hits every architecture. A very large or carefully built function can overflow an internal counter and make Cranelift produce the wrong code, which opens the door to an escape.
• CVE-2026-115893 only affects ARM64. A br_table instruction with more than about 256,000 targets can make a branch jump to the wrong place, and an attacker gets to choose the offset. It's been there since aarch64 support first landed in 2020.

The fixed versions are 36.0.19, 48.0.7 and 49.0.4, and 50.0.0, released October 20, has both fixes. According to The Hacker News, nobody has reported attacks and neither bug was on CISA's exploited list as of today. Older lines, including the 24.x LTS that went out of support in August, aren't getting patches.

Why it matters

An attacker needs to get a vulnerable Wasmtime to compile a module they wrote, so most people's laptops aren't the target. The real risk is for platforms that run other people's code on purpose: serverless and edge hosts, plugin systems, and apps that use WebAssembly as a sandbox. For them, a sandbox escape is about as bad as it gets.

The ARM64 bug worries me more. Lots of cloud servers run on ARM chips now, and The Hacker News says hosts that patched an earlier Cranelift ARM64 bug in April are still exposed to this one.

What to do

• Update to the fixed release on your line, or jump to 50.0.0.
• Rebuild every app that embeds Wasmtime as a library. Updating the command-line tool alone does nothing for them.
• Run cargo audit. Both bugs are in RustSec as RUSTSEC-2026-0380 and RUSTSEC-2026-0379. Don't count on Dependabot alone, because GitHub only had a reviewed entry for one of them.
• Until you've patched, don't run modules from people you don't trust. There's no official workaround.

This week has been rough for tools that are supposed to keep code contained. I also wrote about AGENTS.md files that can hijack AI coding agents.