Two Critical Wasmtime Flaws Could Let Malicious Web Assembly Modules Escape Sandboxes
Summary: Wasmtime's maintainers at the Bytecode Alliance rated two Cranelift compiler flaws 9.9 out of 10 on CVSS in advisories published October 19, both allowing a malicious WebAssembly module to escape the sandbox meant to contain it; one flaw affects only ARM64 systems and has been present since Wasmtime first supported ARM64 in 2020. Fixes shipped October 19 and 20 in 36.0.19, 48.0.7, 49.0.4, and 50.0.0, with no attacks reported and neither flaw in CISA's Known Exploited Vulnerabilities catalog as of October 26.
Why it matters: The risk concentrates in services that compile modules written by others - Fastly says its Compute platform runs customer code on Wasmtime - and because Wasmtime is built in as a library, updating the command-line tool does not fix the programs that embed it; each must be rebuilt. GitHub had no reviewed advisory entry for the ARM64 flaw as of October 26, so Dependabot users should not expect an alert for it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-115889CVE-2026-115893
- Related
- ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026