CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than 256k targets on one brtable instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code...

GHSA-MGHF-WJFP-P5XM Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than 256k targets on one brtable instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code...

EUVD-2026-109188

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm brtable instruction...

CVE-2026-115893

A flaw was found in Wasmtime. When compiling WebAssembly Wasm branch table instructions with an unusually large number of targets on 64-bit ARM AArch64 systems, the Cranelift compiler backend generates an incorrect branch target. An attacker supplying a specially crafted WebAssembly module can...

CVE-2026-115889

A flaw was found in Wasmtime. An attacker could achieve a sandbox escape and compromise the host system by supplying a specially crafted WebAssembly Wasm module. When compiling functions containing an unusually large number of internal values, an integer overflow in the Cranelift compiler backend...

CVE-2026-115384

A flaw was found in Wasmtime. A malicious guest can trigger a stack-based buffer overflow by supplying asynchronous callback functions with mismatched result types. This vulnerability allows the guest to overwrite host stack memory, enabling them to escape the WebAssembly Wasm sandbox, potentiall...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

EUVD-2026-112393

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

CVE-2026-118688

The wasmtime-wasi component in Wasmtime versions before 36.0.18 , 37.0.0 before 48.0.6 , and 49.0.0 before 49.0.3 contains a vulnerability where it re-appends a trailing slash to rename source paths. This behavior causes the renameat system call on macOS and FreeBSD hosts to follow directory syml...

PT-2026-129161

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to...

Exploit for CVE-2026-115893

CVE-2026-115893: Wasmtime aarch64 Sandbox Escape A working fu...

Linux Distros Unpatched Vulnerability : CVE-2026-115385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests ...

Linux Distros Unpatched Vulnerability : CVE-2026-115384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write 16KB to the native...

Linux Distros Unpatched Vulnerability : CVE-2026-115388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for...

Wasmtime 49.0.3 AArch64 Sandbox Escape

Wasmtime versions before 36.0.19, 37.0.0 through 48.0.6, and 49.0.0 through 49.0.3 contain an AArch64 Cranelift brtable branch-target flaw. The proof of concept diverts execution to a JIT literal pool to demonstrate host code execution. https://packetstorm.news/download/237864...

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they...

UBUNTU-CVE-2026-115384

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write 16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions ...