Wasmtime Cranelift Bit-Packing Silent Overflow Miscompilation (CVE-2026-115889)

// Detect vulnerable Wasmtime binaries/processes on managed endpoints (Microsoft Defender for Endpoint)
let vulnerableBelow36 = dynamic(["36.0.0","35","34","33","32","31","30"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("wasmtime", "wasmtime.exe") or ProcessVersionInfoProductName has "wasmtime" or ProcessCommandLine has "wasmtime"
| extend Ver = extract(@"(\d+)\.(\d+)\.(\d+)", 0, ProcessVersionInfoProductVersion)
| extend Major = toint(extract(@"^(\d+)\.", 1, Ver)), Minor = toint(extract(@"^\d+\.(\d+)\.", 1, Ver)), Patch = toint(extract(@"^\d+\.\d+\.(\d+)", 1, Ver))
| extend IsVulnerable = iff(
    (Major < 36) or
    (Major == 36 and Minor == 0 and Patch < 19) or
    (Major >= 37 and Major < 43), true, false)
| where IsVulnerable == true or isempty(Ver)
| project Timestamp, DeviceName, FileName, Ver, ProcessVersionInfoProductVersion, ProcessCommandLine, InitiatingProcessFileName, AccountName

index=endpoint (process_name="wasmtime" OR process_name="wasmtime.exe" OR process="*wasmtime*")
| rex field=process "(?<ver>\d+\.\d+\.\d+)"
| rex field=ver "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)"
| eval major=tonumber(major), minor=tonumber(minor), patch=tonumber(patch)
| eval is_vulnerable=if((major<36) OR (major==36 AND minor==0 AND patch<19) OR (major>=37 AND major<43), "true", "false")
| where is_vulnerable="true" OR isnull(ver)
| table _time host user process_name ver process parent_process_name

process where event.type == "start" and
  (process.name : ("wasmtime", "wasmtime.exe") or process.command_line : "*wasmtime*") and
  not process.version : ("36.0.19", "36.0.2?", "43.*", "44.*", "45.*", "46.*")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Process Version" AS version, sourceip, username, starttime
FROM events
WHERE (LOWER("Process Name") LIKE '%wasmtime%' OR LOWER(payload) LIKE '%wasmtime%')
AND (
  "Process Version" IMATCHES '^([0-9]|[12][0-9]|3[0-5])\..*'
  OR "Process Version" IMATCHES '^36\.0\.([0-9]|1[0-8])$'
  OR "Process Version" IMATCHES '^(3[7-9]|4[0-2])\..*'
  OR "Process Version" IS NULL
)
LAST 7 DAYS

_sourceCategory=*endpoint* ("wasmtime")
| parse regex "(?<proc>wasmtime[^\s\"]*)" nodrop
| parse regex "(?<ver>\d+\.\d+\.\d+)" nodrop
| parse regex field=ver "(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)" nodrop
| if((major<36) or (major==36 and minor==0 and patch<19) or (major>=37 and major<43), "true", "false") as is_vulnerable
| where is_vulnerable="true" or isNull(ver)
| fields _messagetime, _sourcehost, proc, ver, is_vulnerable

rule wasmtime_cve_2026_115889_vulnerable_version {
  meta:
    author = "Argus Detection Platform"
    description = "Detects execution of Wasmtime versions vulnerable to CVE-2026-115889 Cranelift bit-packing miscompilation"
    cve = "CVE-2026-115889"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.principal.process.file.full_path, `(?i)wasmtime`) or
      re.regex($e.principal.process.command_line, `(?i)wasmtime`)
    )
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| (FileName=/wasmtime/i or CommandLine=/wasmtime/i)
| regex("(?<ver>\\d+\\.\\d+\\.\\d+)", field=CommandLine, strict=false)
| regex("(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)", field=ver, strict=false)
| major := parseInt(major) | minor := parseInt(minor) | patch := parseInt(patch)
| case {
    major<36 | is_vulnerable := "true";
    major=36 and minor=0 and patch<19 | is_vulnerable := "true";
    major>=37 and major<43 | is_vulnerable := "true";
    * | is_vulnerable := "false";
  }
| is_vulnerable="true"
| table([@timestamp, ComputerName, UserName, FileName, ver, CommandLine])