Webassembly

vulnerabilities 2026-10-27 Critical
Wasmtime Cranelift Flaws CVE-2026-115889 and CVE-2026-115893 Let Malicious WebAssembly Escape the Sandbox
Two CVSS 9.9 miscompilation bugs in Wasmtime's default Cranelift compiler let an attacker-supplied WebAssembly module break out of its sandbox; fixes shipped October 19.
sandbox-escape webassembly rust cloud open-source memory-corruption

Wasmtime Cranelift Flaws CVE-2026-115889 and CVE-2026-115893 Let Malicious WebAssembly Escape the Sandbox