CVE-2026-115889: Silent Overflow Miscompilation in Wasmtime's Cranelift Compiler Enables Sandbox Escape

What's the Vulnerability

CVE-2026-115889 is a type-confusion and incorrect-truncation flaw (CWE-197, CWE-843) in the bit-packing logic of Wasmtime's Cranelift compiler backend. Cranelift miscompiles certain guest code paths, causing a silent integer overflow during code generation rather than a crash or compile error. The result is that WebAssembly modules can be compiled into incorrect native code.

Because the miscompilation is silent, it can bypass the sandbox bounds checks that Wasm's memory isolation model depends on. A malicious or attacker-influenced Wasm module loaded into an affected host may trigger memory corruption and ultimately a full sandbox escape. The flaw carries a CVSS score of 9.9 — reflecting that successful exploitation compromises the core isolation guarantee Wasmtime is designed to provide.

Affected Software

The vulnerability affects the wasmtime runtime, maintained under the Rust project. Specifically impacted version ranges are:

• < 36.0.19
• >= 37.0.0, < 43.0.0

Remediation requires upgrading to 36.0.19 or 43.0.0+. No patch date has been published yet, so teams should track vendor advisories for the finalized fix release.

Exploitation Status

A public proof-of-concept exists for this vulnerability. This is not yet confirmed as weaponized in the wild or listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but public PoC availability materially lowers the bar for exploitation and typically accelerates both researcher and attacker interest. Given the sandbox-escape impact and the maturity of the exploit code, this should be treated as a high-priority patching item rather than a theoretical concern.

How Our Detection Catches It

Our detection ships across seven SIEM platforms: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL).

Rather than attempting to catch exploitation of a miscompilation in flight — which is impractical from log telemetry alone — the detection logic focuses on exposure identification and precursor activity:

• Identifying vulnerable Wasmtime binaries present on hosts, matched against the affected version ranges.
• Scanning dependency manifests (e.g., Cargo.lock, container image metadata) that pin an affected Wasmtime version.
• Monitoring runtime process and compilation activity involving Wasmtime, to flag environments actively invoking the vulnerable Cranelift code paths.

This gives defenders a way to inventory exposure at scale and prioritize upgrades before weaponized exploitation catches up to the public PoC.

Full Detection Details

For the complete detection logic, affected-version matching, and per-platform queries, see the full CVE-2026-115889 detection page.