CVE-2026-115893

Summary

A flaw in Cranelift's aarch64 backend allows a malicious WebAssembly module to craft a br_table with over ~256,000 targets, causing an incorrect conditional branch that jumps to arbitrary code at a user-controlled offset, breaking out of Wasmtime's sandbox.

Exploitability

Exploitation requires the attacker to control a Wasm module and deploy it on a vulnerable Wasmtime instance running on aarch64 with the default Cranelift backend; no user interaction or high privileges beyond low-privilege Wasm execution are needed.

Blast radius

Successful exploitation allows full compromise of the host process — arbitrary code execution, data theft, and potential lateral movement — effectively turning a sandbox escape into full system compromise on affected platforms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Wasmtime version 36.0.19, 48.0.7, or 49.0.4 (or later) to patch the Cranelift aarch64 br_table miscompilation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.