{"id":"ghsa-ghsa-mghf-wjfp-p5xm","seq":2056932,"kind":"advisory","title":"Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","url":"https://github.com/advisories/GHSA-mghf-wjfp-p5xm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mghf-wjfp-p5xm","summary":"影響: rust:wasmtime < 36.0.19 → 36.0.19, rust:wasmtime >= 37.0.0, < 48.0.7 → 48.0.7, rust:wasmtime >= 49.0.0, < 49.0.4 → 49.0.4\nWhen running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one br_table instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. Impact Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm mod…","severity":"critical","techs":["rust","wasmtime"],"cves":["CVE-2026-115893"],"tags":["GHSA-mghf-wjfp-p5xm","wasmtime","wasmtime","wasmtime"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:14:14.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}