Wasmtime Sandbox Escape Flaws Patched in Cranelift

Reported by SOCRadar (Yağmur Ernalbant)

Summary by Cyber Security News27 Oct 2026, 08:29 CET

About this summary. This is a short excerpt from the description that SOCRadar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://socradar.io/blog/wasmtime-sandbox-escape-cranelift/

Two critical Wasmtime sandbox escape flaws, CVE-2026-115889 and CVE-2026-115893, let a crafted WebAssembly (Wasm) module push the Cranelift compiler into generating unsafe machine code. The Bytecode Alliance fixed both on October 19, 2026, and rated each 9.9 under CVSS v3.1. Platforms that compile Wasm from customers or other outside parties carry the most risk, because they depend on Wasmtime to keep that code contained.

Read the full article at SOCRadar →

Source attribution: headline and facts are from SOCRadar (socradar.io). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

From Hijacked PBX to Stolen Trunk: INJ3CTOR3’s Campaign Evolves

Byte Debt: From an HTTP Header Typo to Cross-User Session Fixation

Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog

Signal Vulnerability Could Keep Calls Alive After Users Hang Up

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise