CVE-2026-115893

criticalPriorität · verfolgen · 10EPSS 0.010 · 62. PerzentilExploit · PoCUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.99% (62nd) EPSS

CVSS 9.9 · critical

Is it mine?

3 products

Prüfe deine Angriffsfläche

Who says so?

1 sources

osv

EPSS · bewertet 2026-10-28

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.9

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 3.1 · Auswirkung 6

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-691USprimär

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escapeCVE-2026-115893: full Wasmtime aarch64 Cranelift br_table sandbox-escape public exploit, PoV, calibration notes, and verification evidence.PoC · poc_in_github

betroffene Produkte (3)

Betroffene Produkte und Versionsbereiche.

crates.io wasmtime0.0.0-0 → 36.0.19osvUSpkg:cargo/wasmtime
crates.io wasmtime37.0.0 → 48.0.7osvUSpkg:cargo/wasmtime
crates.io wasmtime49.0.0 → 49.0.4osvUSpkg:cargo/wasmtime

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

RUSTSEC-2026-0379Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction2026-10-19vendor · osvUS
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory.

auch bekannt als (1)

Weitere Namen und Kennungen dieser Entität.

GHSA-mghf-wjfp-p5xm osv

quellen

Welche Quellen diesen Datensatz belegen und wann.

osv NVD CVE.org MITRE

veröffentlicht 2026-10-23geändert 2026-10-23

verwandt (180)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-20559US	high8.8	0.67% (52nd)	—	2023-04-02
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
CVE-2026-20276US	high8.6	0.47% (40th)	—	2026-09-02
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review.…
CVE-2022-20697US	high8.6	1.16% (67th)	—	2022-04-15
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condi…
CVE-2024-37158US	high8.1	0.44% (38th)	—	2024-06-17
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Ev…
CVE-2016-2200US	high7.5	6.37% (94th)	—	2016-02-08
Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102.

+175 weitere

Referenzen (12) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan