---
title: "CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation"
url: https://erroneo.us/security/cve/CVE-2026-115889/
description: "CVE-2026-115889 (wasmtime (crates.io (Rust))): Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-23
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-115889"
kev: false
cvss: 9.9
epss: null
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes wasmtime (crates.io (Rust)) < 36.0.19, fixed in 36.0.19 ; wasmtime (crates.io (Rust)) >= 37.0.0, < 43.0.0, fixed in 43.0.0 . Check your lockfile, including transitive dependencies.

## What it is

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.

## Affected packages

- crates.io (Rust) `wasmtime` < 36.0.19 → fixed: 36.0.19
- crates.io (Rust) `wasmtime` >= 37.0.0, < 43.0.0 → fixed: 43.0.0

## Affected products (CVE record)

- bytecodealliance wasmtime: < 36.0.19, >= 37.0.0, < 43.0.0

## Severity

- GitHub_M CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).

## Sources

- [GitHub Advisory GHSA-897f-g5gm-fmxm](https://github.com/advisories/GHSA-897f-g5gm-fmxm)
- [CVE.org record CVE-2026-115889](https://www.cve.org/CVERecord?id=CVE-2026-115889)
- [NVD entry CVE-2026-115889](https://nvd.nist.gov/vuln/detail/CVE-2026-115889)
- [github.com](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm)
- [github.com](https://github.com/bytecodealliance/wasmtime/pull/12613)
- [github.com](https://github.com/bytecodealliance/wasmtime/pull/14818)
- [github.com](https://github.com/bytecodealliance/wasmtime/commit/ba8f7d70caa1825b7f64fa75cd9d03f4a438dae0)
- [github.com](https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa)
- [github.com](https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19)
- [github.com](https://github.com/bytecodealliance/wasmtime/releases/tag/v43.0.0)
- [rustsec.org](https://rustsec.org/advisories/RUSTSEC-2026-0380.html)

---
Source page: https://erroneo.us/security/cve/CVE-2026-115889/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt