The Hacker News reported on October 26 that two flaws in Wasmtime, which runs WebAssembly outside browsers, could let a hostile module escape its sandbox. The Bytecode Alliance, its maintainer, rated each flaw 9.9 out of 10 on the CVSS severity scale. Both bugs are in Cranelift, its default compiler. CVE-2026-115889 affects default setups on any platform; CVE-2026-115893 affects only ARM64. The maintainers have reported no attacks.
In CVE-2026-115889, Cranelift before version 43 packed value numbers into 24-bit fields. In release builds, a number too big overflowed silently, so code could point at the wrong value. The sources do not explain the ARM64 flaw or say what an attacker could reach after escaping. Neither flaw was in CISA's Known Exploited Vulnerabilities catalog on October 26. Version 50.0.0 fixes both. The sources list 36.0.19, 48.0.7 and 49.0.4 as fixes for their lines but do not say if each covers both. Other lines, such as 24.x, got no fix.
Risk is highest where outsiders supply modules, because an attacker needs a vulnerable build to compile a module they control. Fastly says its Compute platform runs customer code using Wasmtime. Wasmtime is a library, so a fix reaches a product only after its vendor rebuilds it. Ask vendors and your own teams: is Wasmtime embedded, which line, and rebuilt?