CVE-2026-115893: CWE-691: Insufficient Control Flow Management in bytecodealliance wasmtime

Wasmtime is a WebAssembly runtime that uses the Cranelift compiler backend. On aarch64 architectures, prior to versions 36.0.19, 48.0.7, and 49.0.4, the Cranelift backend incorrectly compiles the br_table instruction when it has more than roughly 256,000 targets. This results in an incorrect conditional branch target, enabling a user-controlled Wasm module to jump to arbitrary code offsets. This behavior allows sandbox escape, compromising the isolation guarantees of the runtime. The vulnerability is identified as CWE-691 (Insufficient Control Flow Management) and has a CVSS 3.1 score of 9.9, indicating critical severity. The flaw is patched in the specified fixed versions.

Successful exploitation allows a malicious WebAssembly module to escape the sandbox on aarch64 systems using the default Cranelift backend in Wasmtime. This can lead to arbitrary code execution with the privileges of the Wasmtime process, potentially compromising confidentiality, integrity, and availability of the host system. The vulnerability affects the security boundary of the runtime, making it critical for environments relying on Wasmtime sandboxing.

Upgrade Wasmtime to version 36.0.19, 48.0.7, or 49.0.4 or later, depending on your version stream. These versions contain the official fix for this vulnerability. No other mitigation is required once updated. If upgrading is not immediately possible, restrict usage of untrusted WebAssembly modules on affected versions as a temporary measure.