{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "bytecodealliance wasmtime: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/bytecodealliance--wasmtime/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/bytecodealliance--wasmtime/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115893/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115893/",
   "title": "CVE-2026-115893 · bytecodealliance wasmtime · disclosed",
   "content_text": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.",
   "date_published": "2026-10-23T21:29:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115893/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115893/",
   "title": "CVE-2026-115893 · bytecodealliance wasmtime · fixed upstream (crates.io)",
   "content_text": "Fixed versions: wasmtime 36.0.19, wasmtime 48.0.7, wasmtime 49.0.4.",
   "date_published": "2026-10-23T21:29:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115889/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115889/",
   "title": "CVE-2026-115889 · bytecodealliance wasmtime · disclosed",
   "content_text": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.",
   "date_published": "2026-10-23T21:23:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115889/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115889/",
   "title": "CVE-2026-115889 · bytecodealliance wasmtime · fixed upstream (crates.io)",
   "content_text": "Fixed versions: wasmtime 36.0.19, wasmtime 43.0.0.",
   "date_published": "2026-10-23T21:23:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115392/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115392/",
   "title": "CVE-2026-115392 · bytecodealliance wasmtime · disclosed",
   "content_text": "Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write access to any sandboxed directory can read and write any host-accessible file, and read-only guests may read host files via preexisting symlinks.",
   "date_published": "2026-10-22T19:13:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115392/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115392/",
   "title": "CVE-2026-115392 · bytecodealliance wasmtime · fixed upstream (crates.io)",
   "content_text": "Fixed versions: wasmtime 24.0.13, wasmtime 36.0.14, wasmtime 46.0.3, wasmtime 47.0.4.",
   "date_published": "2026-10-22T19:13:58Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115384/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115384/",
   "title": "CVE-2026-115384 · bytecodealliance wasmtime · disclosed",
   "content_text": "Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.",
   "date_published": "2026-10-22T19:13:51Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115384/fixed/crates.io",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115384/",
   "title": "CVE-2026-115384 · bytecodealliance wasmtime · fixed upstream (crates.io)",
   "content_text": "Fixed versions: wasmtime 48.0.4, wasmtime 49.0.2.",
   "date_published": "2026-10-22T19:13:51Z"
  }
 ]
}