CVE-2026-115893

criticalpriority · track · 10EPSS 0.010 · 62 %ileexploit · PoCUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.99% (62nd) EPSS

CVSS 9.9 · critical

Is it mine?

3 products

Check your exposure

Who says so?

1 sources

osv

EPSS · scored 2026-10-28

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

cvss

Technical severity, 0–10. One row per scoring source.

9.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 3.1 · impact 6

v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV

v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-691USprimary

exploits (1)

Public proof-of-concept and weaponised exploit code.

shreyas-malhotra/CVE-2026-115893-wasmtime-sandbox-escapeCVE-2026-115893: full Wasmtime aarch64 Cranelift br_table sandbox-escape public exploit, PoV, calibration notes, and verification evidence.PoC · poc_in_github

affected products (3)

Products and version ranges known to be affected.

crates.io wasmtime0.0.0-0 → 36.0.19osvUSpkg:cargo/wasmtime
crates.io wasmtime37.0.0 → 48.0.7osvUSpkg:cargo/wasmtime
crates.io wasmtime49.0.0 → 49.0.4osvUSpkg:cargo/wasmtime

advisories (1)

Vendor and ecosystem advisories describing this.

RUSTSEC-2026-0379Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction2026-10-19vendor · osvUS
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory.

also known as (1)

Other names and identifiers for this entity.

GHSA-mghf-wjfp-p5xm osv

sources

Which sources assert this record, and when.

osv NVD CVE.org MITRE

published 2026-10-23modified 2026-10-23

related (180)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2023-20559US	high8.8	0.67% (52nd)	—	2023-04-02
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
CVE-2026-20276US	high8.6	0.47% (40th)	—	2026-09-02
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review.…
CVE-2022-20697US	high8.6	1.16% (67th)	—	2022-04-15
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condi…
CVE-2024-37158US	high8.1	0.44% (38th)	—	2024-06-17
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Ev…
CVE-2016-2200US	high7.5	6.37% (94th)	—	2016-02-08
Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102.

+175 more

references (12) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan