RUSTSEC-2026-0379 CVE-2026-115893 GHSA-mghf-wjfp-p5xm

Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Critical crates.io

Severity: 9.9 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 0.99%; Chance of exploitation in the next 30 days. Higher than 62.52% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-691 Insufficient Control Flow Management
Fix: 36.0.19; Upgrade wasmtime to this version or later

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory.

Affected versions

crates.io

Package	Vulnerable	Fixed in
wasmtime	`< 36.0.19`	`36.0.19`
wasmtime	`>= 37.0.0, < 48.0.7`	`48.0.7`
wasmtime	`>= 49.0.0, < 49.0.4`	`49.0.4`
wasmtime	`< 36.0.19`	`36.0.19`
wasmtime	`>= 37.0.0, < 48.0.7`	`48.0.7`
wasmtime	`>= 49.0.0, < 49.0.4`	`49.0.4`
wasmtime	`>= 0.0.0-0, < 36.0.19` `>= 37.0.0, < 48.0.7` `>= 49.0.0, < 49.0.4`	`36.0.19` `48.0.7` `49.0.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

wasmtime crates.io → `36.0.19`

cargo

cargo update -p wasmtime --precise 36.0.19

Severity breakdown

CVSS 3.1 9.9

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-691: Insufficient Control Flow Management

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

References

Advisories

Fixes and patches

Packages

Timeline

Oct 19, 2026 Published
Oct 29, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
RUSTSEC-2026-0424 Unchecked memory usage in transferring borrowed resources between components	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0423 Cross-engine type confusion with host-created struct-types-with-supertypes	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0422 Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check	Low	Also affects wasmtime
GHSA-9pvw-hwfg-92h5 Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type	Medium	Also affects wasmtime
GHSA-897f-g5gm-fmxm Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation	Critical	Also affects wasmtime
RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned	Not rated yet	Also affects wasmtime
RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit	Medium	Also affects wasmtime
RUSTSEC-2026-0361 Panic when pending calls are run after a trap	Not rated yet	Also affects wasmtime

Credits: ilyas-mallah

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor