CVE-2026-115889: CWE-197: Numeric Truncation Error in bytecodealliance wasmtime
Description
A numeric truncation error in the Cranelift compiler backend of Wasmtime prior to versions 36.0.19 and 43.0.0 can cause silent overflow when compiling large or specially crafted WebAssembly functions. This overflow leads to incorrect intermediate representation references, resulting in arbitrary miscompilation, type confusion, and potentially attacker-controlled effects that may break out of the Wasm sandbox. The issue is fixed in versions 36.0.19 and 43.0.0.
CVSS v3.1
Score 9.9critical
Affected software
bytecodealliance
wasmtime
pkg:github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wasmtime's Cranelift compiler backend bit-packs SSA value indices in a manner that can silently overflow in release builds when compiling sufficiently large or specially crafted WebAssembly functions with many SSA values. This numeric truncation error (CWE-197) causes Cranelift to reference incorrect IR values, leading to arbitrary miscompilation and type confusion (CWE-843). These effects can be attacker-controlled and may allow escaping the WebAssembly sandbox on any architecture using the default Cranelift backend. The vulnerability is addressed in Wasmtime versions 36.0.19 and 43.0.0.
Potential Impact
Exploitation of this vulnerability can result in arbitrary code execution or other attacker-controlled behavior outside the WebAssembly sandbox, compromising confidentiality, integrity, and availability of the host system. The CVSS 3.1 score of 9.9 reflects critical impact with network attack vector, low attack complexity, and privileges required. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Upgrade Wasmtime to version 36.0.19 or later, or to version 43.0.0 or later, where this numeric truncation error in the Cranelift backend is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-23T19:37:27.176Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adbd340d73cc49347c1efee
Added to database: 10/23/2026, 21:36:00 UTC
Last enriched: 10/23/2026, 21:50:20 UTC
Last updated: 10/23/2026, 21:50:50 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.