CVE-2026-115889

Summary

A silent integer overflow in Cranelift's SSA value indexing can cause miscompilation of large or crafted WebAssembly functions, breaking the Wasm sandbox and enabling arbitrary code execution outside the sandbox.

Exploitability

Exploitation requires a privileged attacker (PR:L) to submit a specially crafted Wasm module with enough SSA values to trigger the overflow; network exposure alone is insufficient.

Blast radius

Successful exploitation allows full compromise of the host running Wasmtime, including data exfiltration, system modification, and potential lateral movement from compromised WebAssembly workloads.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Wasmtime version 36.0.19 or 43.0.0 (or later) to patch the integer overflow in the Cranelift backend.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.