CERT24Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape SandboxesLoading data…
CERT24Threat Observatory
Period

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical flaws in Wasmtime’s Cranelift compiler could allow a WebAssembly module controlled by an attacker to escape its sandbox. CVE-2026-115889 affects all processor architectures, while CVE-2026-115893 affects only ARM64, also called aarch64. The maintainers have not reported any attacks.

← Back to intelligence

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical flaws in Wasmtime’s Cranelift compiler could allow a WebAssembly module controlled by an attacker to escape its sandbox. CVE-2026-115889 affects all processor architectures, while CVE-2026-115893 affects only ARM64, also called aarch64. The maintainers have not reported any attacks.