Affected Systems
Wasmtime WebAssembly runtime: CVE-2026-115889 affects all architectures in versions before 36.0.19 and 37.0.0–42.x; CVE-2026-115893 affects ARM64/aarch64 only in versions before 36.0.19, 37.0.0–47.x, 48.0.0–48.0.6, and 49.0.0–49.0.3. Both flaws are in the Cranelift compiler. Services compiling untrusted WebAssembly modules (e.g., Fastly Compute) face highest risk.
Exploitation Status
No active exploitation reported as of October 26, 2026. Fixes released October 19–20, 2026. Not listed in CISA KEV catalog. Both flaws require attacker-controlled WebAssembly module compiled by vulnerable Wasmtime build.
Business Impact
Malicious WebAssembly modules can escape sandbox containment, breaking memory isolation and control-flow integrity. Impact scope post-escape not specified in advisories. Critical for multi-tenant platforms compiling third-party Wasm code. Wasmtime embedded as library in other software requires rebuilding those applications, not just CLI tool updates. CVSS 9.9/10 per Bytecode Alliance.
Urgency
🟠 Within 24 hours
Recommended Actions
- Update Wasmtime to fixed versions: 36.0.19 (LTS), 48.0.7, 49.0.4, or 50.0.0 or later depending on current release line
- Identify all applications embedding Wasmtime as a library and rebuild them with patched Wasmtime versions—updating the standalone CLI tool is insufficient
- For ARM64 hosts previously patched to 36.0.7, 42.0.2, or 43.0.1 in April 2026: re-patch to address CVE-2026-115893
- Run cargo-audit against Cargo.lock files to detect RUSTSEC-2026-0380 and RUSTSEC-2026-0379; note GitHub Dependabot may not alert for CVE-2026-115893
- Prioritize patching for services compiling untrusted or customer-supplied WebAssembly modules (e.g., serverless platforms, edge compute)