| Name | CVE-2026-115893 |
| Description | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1151861 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| rust-wasmtime (PTS) | trixie | 26.0.1+dfsg-3 | vulnerable |
| sid, forky | 36.0.13+dfsg-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| rust-wasmtime | source | (unstable) | (unfixed) | 1151861 |
https://rustsec.org/advisories/RUSTSEC-2026-0379.html
https://github.com/advisories/GHSA-mghf-wjfp-p5xm
https://github.com/bytecodealliance/wasmtime/pull/14826