The Bytecode Alliance has disclosed two critical flaws in Wasmtime, the WebAssembly runtime that can be embedded in other software, each rated 9.9 on the CVSS scale in advisories published on 19 October. Both bugs sit in Cranelift, the compiler Wasmtime uses by default to translate WebAssembly into machine code, and both would let a malicious module escape the sandbox meant to contain it — a module is only supposed to touch its own memory, the host functions it is given, and checked jump targets. CVE-2026-115889 affects every processor architecture; CVE-2026-115893 affects only ARM64. Exploitation requires the victim to compile a module the attacker controls, which makes the risk highest for services that run customer-supplied or third-party code — Fastly, for example, states that its Compute platform runs customer code on Wasmtime. Fixed versions were released on 19 and 20 October, with the remedy depending on the release line: 36.0.19 and 48.0.7 are clean, 37.0.0 through 42.x must move to 48.0.7, 49.0.4 or 50.0.0, and 43.0.0 through 47.x are affected by the ARM64 flaw only. The maintainers report no attacks, and neither flaw was in CISA's Known Exploited Vulnerabilities catalogue as of 26 October.

• Source article