Wasmtime Cranelift compiler SSA index bit-packing overflow enabling sandbox escape

CVE-2026-115889 is a numeric truncation error (CWE-197) in the Cranelift compiler backend used by Wasmtime, the Bytecode Alliance's reference WebAssembly runtime. Cranelift bit-packs SSA (Static Single Assignment) value indices into a fixed-width field — reportedly 24 bits in earlier internal representations. In release builds, Rust's default integer-overflow behavior is wrapping (not panicking), so when a WebAssembly function contains enough SSA values to exceed the bit-packed capacity, the index silently wraps around. The result: Cranelift references the *wrong* IR value during code generation, producing arbitrary miscompilation. Because the miscompiled code runs inside the Wasm sandbox engine itself, an attacker who controls the Wasm module can leverage the resulting type confusion (CWE-843) to read/write outside the sandbox's linear memory, achieving full host-process compromise. All architectures using the default Cranelift backend are affected across Wasmtime versions < 36.0.19 and 37.0.0 through 42.x. Fixes ship in 36.0.19 (LTS backport) and 43.0.0, which upgrade the index to a full u32 with overflow checks.

The vendor's CRITICAL 9.9 rating is aggressive but defensible for Wasmtime's canonical deployment role. Wasmtime exists *specifically* to sandbox untrusted WebAssembly — it is the security boundary, analogous to a hypervisor or container runtime. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C captures this well: the attacker submits a crafted module over the network with low privileges (a platform tenant account), no user interaction, and the impact crosses from the Wasm guest into the host process (Scope: Changed). Where we trim from 9.9 to 9.4 is on practical grounds: there is no public proof-of-concept, no observed in-the-wild exploitation, the EPSS probability sits at a low 0.45%, and crafting the trigger module requires nontrivial understanding of Cranelift IR internals. These temporal factors reduce immediate operational risk but do not change the fundamental severity class — this remains a CRITICAL sandbox-escape primitive.

Sources.

1. GitHub Security Advisory (GHSA-897f-g5gm-fmxm)
2. RustSec Advisory RUSTSEC-2026-0380
3. GitLab Advisory Database
4. The Hacker News — Two Critical Wasmtime Flaws
5. VulDB — CVE-2026-115889
6. Bytecode Alliance Wasmtime Security Advisories
7. Helix Threat Watch — CVE-2026-115889

Run on any host where Wasmtime is installed as a CLI binary or embedded as a Cargo dependency. Execute from the project root (for Cargo.lock checks) or any shell where wasmtime is in PATH. No special privileges required. Example: bash check_cve_2026_115889.sh

#!/usr/bin/env bash
# CVE-2026-115889 — Wasmtime Cranelift SSA bit-packing overflow checker
# Checks installed wasmtime version against patched versions.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -euo pipefail

echo "=== CVE-2026-115889 Wasmtime Version Check ==="
VER=""
SOURCE=""

# Method 1: wasmtime CLI binary
if command -v wasmtime &>/dev/null; then
    VER=$(wasmtime --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    SOURCE="wasmtime CLI"
fi

# Method 2: Cargo.lock dependency
if [ -z "$VER" ] && [ -f "Cargo.lock" ]; then
    VER=$(grep -A1 'name = "wasmtime"' Cargo.lock 2>/dev/null | grep 'version' | head -1 | sed 's/.*"\([0-9.]*\)".*/\1/')
    SOURCE="Cargo.lock"
fi

# Method 3: cargo tree
if [ -z "$VER" ] && command -v cargo &>/dev/null && [ -f "Cargo.toml" ]; then
    VER=$(cargo tree -p wasmtime 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' || true)
    SOURCE="cargo tree"
fi

if [ -z "$VER" ]; then
    echo "UNKNOWN — wasmtime not found (not in PATH, Cargo.lock, or Cargo.toml)"
    exit 2
fi

echo "Detected wasmtime $VER via $SOURCE"

IFS='.' read -r MAJOR MINOR PATCH <<< "$VER"

# Patched: (>= 43.0.0) OR (>= 36.0.19 AND < 37.0.0)
# Vulnerable: (< 36.0.19) OR (>= 37.0.0 AND < 43.0.0)
if [ "$MAJOR" -ge 43 ]; then
    echo "PATCHED — $VER >= 43.0.0"
    exit 0
elif [ "$MAJOR" -eq 36 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 19 ]; then
    echo "PATCHED — $VER >= 36.0.19 (LTS backport)"
    exit 0
elif [ "$MAJOR" -ge 37 ] && [ "$MAJOR" -lt 43 ]; then
    echo "VULNERABLE — $VER is in range 37.x-42.x; upgrade to >= 43.0.0"
    exit 1
elif [ "$MAJOR" -eq 36 ]; then
    if [ "$MINOR" -gt 0 ] || [ "$PATCH" -lt 19 ]; then
        echo "VULNERABLE — $VER < 36.0.19; upgrade to >= 36.0.19 or >= 43.0.0"
        exit 1
    fi
elif [ "$MAJOR" -lt 36 ]; then
    echo "VULNERABLE — $VER < 36.0.19; upgrade to >= 36.0.19 or >= 43.0.0"
    exit 1
fi

echo "UNKNOWN — could not classify version $VER"
exit 2