{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "36.0.19"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "introduced": "37.0.0"
                  },
                  {
                    "fixed": "48.0.7"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "introduced": "49.0.0"
                  },
                  {
                    "fixed": "49.0.4"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "fixed": "222ff3a65dab9aa7011f8c246937751a0bac5abd"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "994549891c8a706cb4f2809f9d17b9f67b31e618"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "e61df1b454be9313d61a5f8de07722a421139bbe"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "range": [
                  {
                    "fixed": "f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "original_tag": "v36.0.19",
                "range": [
                  {
                    "fixed": "0d6b8ead4e94b0ce76f925611b831b56570aef94"
                  }
                ],
                "source": "REFERENCES_TAG"
              },
              {
                "original_tag": "v48.0.7",
                "range": [
                  {
                    "fixed": "c6846e13f64b07b7912d372db141397058b55f99"
                  }
                ],
                "source": "REFERENCES_TAG"
              },
              {
                "original_tag": "v49.0.4",
                "range": [
                  {
                    "fixed": "2c2970205fe05d6bbf15b9bff6f1e67874b2db5c"
                  }
                ],
                "source": "REFERENCES_TAG"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0d6b8ead4e94b0ce76f925611b831b56570aef94"
            },
            {
              "introduced": "7b3d6ae79e9153a2477668062f5622c10333925f"
            },
            {
              "fixed": "c6846e13f64b07b7912d372db141397058b55f99"
            },
            {
              "introduced": "17830bd3c0331d920a8aa38846eebc4d46d98c23"
            },
            {
              "fixed": "2c2970205fe05d6bbf15b9bff6f1e67874b2db5c"
            },
            {
              "fixed": "222ff3a65dab9aa7011f8c246937751a0bac5abd"
            },
            {
              "fixed": "994549891c8a706cb4f2809f9d17b9f67b31e618"
            },
            {
              "fixed": "e61df1b454be9313d61a5f8de07722a421139bbe"
            },
            {
              "fixed": "f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"
            }
          ],
          "repo": "https://github.com/bytecodealliance/wasmtime",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-mghf-wjfp-p5xm"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-691"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115893.json"
  },
  "details": "Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.",
  "id": "CVE-2026-115893",
  "modified": "2026-10-31T02:30:30.923792042Z",
  "published": "2026-10-23T21:29:33.917Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115893.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115893"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/e61df1b454be9313d61a5f8de07722a421139bbe"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/f517bd6e890c7c1291ab9fe05d8cc0c9f11e56aa"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14818"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14819"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14820"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14826"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction"
}