CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

CVE-2026-115889

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

CVE-2026-115889

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

EUVD-2026-109186

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make...

CVE-2026-115889

The Wasmtime runtime is vulnerable to a numeric truncation error (CWE-197) and type confusion (CWE-843) in its Cranelift compiler backend prior to versions 36.0.19 and 43.0.0 . The root cause is a silent overflow occurring during the bit-packing of SSA value indices in release builds when process...

RHEL 8 : thunderbird (RHSA-2026:85243)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85243 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

RHEL 10 : thunderbird (RHSA-2026:85240)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85240 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics:...

RHEL 9 : thunderbird (RHSA-2026:85242)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85242 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

PT-2026-122425

Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is...

RockyLinux 10 : thunderbird (RLSA-2026:80674)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80674 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts componen...

RockyLinux 9 : thunderbird (RLSA-2026:80694)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80694 advisory. firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox: Use-after-free in the Layout: Text and Fonts component...

RHEL 9 : thunderbird (RHSA-2026:85241)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85241 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:24260-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24260-1 advisory. Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalation in the Application...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

EUVD-2026-107698

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...