Bytecodealliance Wasmtime: 18 Vulnerabilities Disclosed, Ranging from Critical to Low
Key findings • 18 vulnerabilities disclosed in Bytecodealliance's Wasmtime runtime between October 22-23, 2026. • Critical flaws include arbitrary code execution via compiler bugs and stack b…
Key findings
- 18 vulnerabilities disclosed in Bytecodealliance's Wasmtime runtime between October 22-23, 2026.
- Critical flaws include arbitrary code execution via compiler bugs and stack buffer overflows.
- Multiple vulnerabilities enable denial-of-service conditions through resource exhaustion and fuel accounting flaws.
- Sandbox escape and improper validation issues pose risks to isolated WebAssembly environments.
- Patches are available across various Wasmtime versions, necessitating prompt updates for affected users.
On October 22-23, 2026, a significant batch of 18 vulnerabilities was disclosed in Bytecodealliance's Wasmtime, a runtime for WebAssembly. These vulnerabilities, ranging in severity from Low to Critical, were reported together, highlighting potential risks for applications relying on Wasmtime for secure execution of WebAssembly modules. The disclosures include issues in Wasmtime's Cranelift compiler backend, WASI implementations, and component model handling, with CVSS scores reaching as high as 9.9.
Several critical vulnerabilities were identified in the Cranelift compiler backend. CVE-2026-115893, a Critical (CVSSv3 9.9) vulnerability, arises from an incorrect conditional branch target when compiling br_table instructions with a large number of targets on aarch64, potentially leading to jumps to arbitrary code. Similarly, CVE-2026-115889, also Critical (CVSSv3 9.9), involves an overflow in the way SSA value indices are bit-packed in release builds, which can cause Cranelift to reference incorrect memory locations when compiling large or specially crafted functions. Another Critical vulnerability, CVE-2026-115384 (CVSSv3 9.9), stems from a stack buffer overflow in async callback result types, allowing malicious guests to write approximately 16KB to the native stack, potentially overwriting return addresses.
A notable theme among the disclosed vulnerabilities is the potential for denial of service (DoS) and resource exhaustion. CVE-2026-115391 (Medium, CVSSv3 5.8) describes an uncontrolled resource allocation in the WASIp3 implementation, where guests can offer large buffers to write streams, leading to host memory exhaustion. CVE-2026-115390 (Medium, CVSSv3 5.7) details a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths, allowing guests to evade timeouts and periodic yields for DoS. CVE-2026-115385 (Medium, CVSSv3 6.2) allows guests to abort the Unix host process by calling set-times or set-times-at with negative timestamps. Furthermore, CVE-2026-115387 (Medium, CVSSv3 5.7) involves overflowing filesystem timestamps, causing WASI programs to panic the host. CVE-2026-115380 (Medium, CVSSv3 4.0) exploits the WASI preview 0 poll_oneoff adapter, performing O(n) host work per subscription without fuel consumption, enabling DoS attacks. CVE-2026-115381 (Medium, CVSSv3 4.8) details an unbounded memory allocation in the SinkOutputStream for WASIp2 write-zeroes method, allowing guests to exhaust host memory.
Several vulnerabilities also touch upon security sandbox escapes and improper validation. CVE-2026-115392 (High, CVSSv3 7.9) is a filesystem sandbox escape in wasmtime-wasi due to mishandling of symlinks with trailing slashes on certain kernel versions, allowing guests with write access to escape their sandbox. CVE-2026-115383 (Medium, CVSSv3 4.8) involves improper validation of WebAssembly tags, where malicious guests can mis-type exception object payloads, corrupting the GC heap and causing panics. CVE-2026-115388 (Low, CVSSv3 2.3) bypasses the hostcall fuel limit by not adequately accounting for host allocations when lifting guest values through the Val API. CVE-2026-115393 (Low, CVSSv3 3.8) is a type confusion vulnerability where Store APIs fail to validate that objects belong to the Store's Engine, potentially leading to issues when mixing objects between engines. Lastly, CVE-2026-115386 (Low, CVSSv3 2.6) is an information disclosure vulnerability in fd_readdir that copies uninitialized struct padding into guest memory, potentially revealing host stack data.
The disclosed vulnerabilities affect various versions of Wasmtime. Specific patches are detailed for each CVE, with fixes often appearing in multiple release branches. For instance, CVE-2026-115893 is addressed in versions 36.0.19, 48.0.7, and 49.0.4. CVE-2026-115392 is fixed in versions 24.0.13, 36.0.14, 46.0.3, and 47.0.3. Users are strongly advised to consult the Wasmtime release notes and apply the relevant patches to mitigate these risks.
This extensive batch of vulnerabilities underscores the importance of continuous security auditing for WebAssembly runtimes. Developers and users of Wasmtime should prioritize updating to patched versions to protect against potential exploitation, particularly those involving critical flaws and sandbox escapes. The variety of issues, from compiler bugs to WASI implementation flaws, highlights the complex attack surface of WebAssembly runtimes and the need for robust security practices throughout the development lifecycle.
The following CVEs were part of this disclosure: CVE-2026-115893, CVE-2026-115892, CVE-2026-115889, CVE-2026-115393, CVE-2026-115392, CVE-2026-115391, CVE-2026-115390, CVE-2026-115389, CVE-2026-115388, CVE-2026-115387, CVE-2026-115386, CVE-2026-115385, CVE-2026-115384, CVE-2026-115383, CVE-2026-115382, CVE-2026-115381, CVE-2026-115380, CVE-2026-115379.