Wasmtime'dagi, boshqa dasturiy ta'minotga o'rnatilishi mumkin bo'lgan WebAssembly ishlash muhitidagi ikkita jiddiy kamchilik, zararli WebAssembly moduliga uni saqlash uchun mo'ljallangan sandbox'dan qochish imkonini berishi mumkin, deb aytishadi loyihaning saqlovchilari.
Hujumchi avval zaif Wasmtime tuzilmasiga o'zi nazorat qiladigan modulni kompilyatsiya qilishni talab qiladi va kamchiliklardan biri faqat ARM64 tizimlariga ta'sir qiladi. Tuzatilgan versiyalar 19 va 20-oktabrda chiqarildi va saqlovchilar hech qanday hujumlar haqida xabar bermagan.
Wasmtime WebAssembly kodini veb-brauzerlardan tashqarida ishlatadi. Ikkala xato ham Cranelift'da, ya'ni WebAssembly'ni mashina kodiga aylantirish uchun ishlatiladigan kompilyatorda. Bytecode Alliance'dagi Wasmtime saqlovchilari 19-oktabrda e'lon qilingan maslahatlarda har bir kamchilikni CVSS shkalasi bo'yicha 10 dan 9,9 deb baholagan.
- CVE-2026-115889 Wasmtime'ga barcha protsessor arxitekturalarida ta'sir qiladi.
- CVE-2026-115893 faqat ARM64, ya'ni aarch64'ga ta'sir qiladi.
Sandbox modulni belgilangan chegaralar ichida saqlash uchun mo'ljallangan. Modul faqat o'z xotirasidan va unga berilgan host funksiyalaridan foydalanishi mumkin, va uning kodi faqat tekshirilgan joylarga sakrashi mumkin.
Ikkala kamchilik ham hujumchi nazorat qiladigan modulni talab qilgani uchun, xavf boshqa odamlar yozgan modullarni kompilyatsiya qiladigan xizmatlar uchun eng yuqori. Masalan, Fastly o'zining Compute platformasi mijoz kodini Wasmtime yordamida ishlatishini aytadi. Maslahatlarda ta'sirlangan xizmatlar nomlanmagan va hujumchi sandbox'dan qochgandan keyin nimaga kirishi mumkinligi aniqlanmagan.
Ikkala kamchilik ham 26-oktabr holatiga ko'ra AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) tomonidan saqlanadigan Ma'lum Foydalanilgan Zaifliklar katalogida yo'q edi.
Qaysi Versiyalar Ta'sirlangan
Ikkita kamchilik turli vaqtlarda tuzatilgani uchun, sizning versiyangiz ta'sirlanganmi yoki yo'qmi, sizning reliz liniyangizga va, bitta kamchilik uchun, protsessor arxitekturasiga bog'liq.
| Wasmtime versiyasi | CVE-2026-115889 (har qanday arxitektura) | CVE-2026-115893 (faqat ARM64) | Nima qilish kerak |
|---|---|---|---|
| 36.0.19 dan oldin (24.x ni o'z ichiga oladi) | Ta'sirlangan | Ta'sirlangan | 36.0.19 ga yangilang, yoki 48.0.7, 49.0.4 yoki 50.0.0 ga o'ting |
| 36.0.19 | Tuzatilgan | Tuzatilgan | Bu kamchiliklar uchun hech narsa kerak emas |
| 37.0.0 dan 42.x gacha | Ta'sirlangan | Ta'sirlangan | 48.0.7, 49.0.4 yoki 50.0.0 ga o'ting |
| 43.0.0 dan 47.x gacha | Ta'sirlanmagan | Ta'sirlangan | 48.0.7, 49.0.4 yoki 50.0.0 ga o'ting |
| 48.0.0 dan 48.0.6 gacha | Ta'sirlanmagan | Ta'sirlangan | 48.0.7 ga yangilang |
| 48.0.7 | Ta'sirlanmagan | Tuzatilgan | Bu kamchiliklar uchun hech narsa kerak emas |
| 49.0.0 dan 49.0.3 gacha | Ta'sirlanmagan | Ta'sirlangan | 49.0.4 ga yangilang |
| 49.0.4 va 50.0.0 yoki undan keyingi | Ta'sirlanmagan | Tuzatilgan | Bu kamchiliklar uchun hech narsa kerak emas |
Wasmtime uzoq muddatli qo'llab-quvvatlash (LTS) relizlarini, ya'ni 12 ga ko'paytirilgan raqamli relizlarni, ikki yil davomida qo'llab-quvvatlaydi. Boshqa relizlar ikki oy oladi. Xavfsizlik tuzatishlari qo'llab-quvvatlanadigan relizlar uchun kafolatlanadi.
Faqat 36, 48, 49 va 50 reliz liniyalari hali ham qo'llab-quvvatlanadi. Boshqa barcha liniyalar, shu jumladan 24.x LTS liniyasi, uning qo'llab-quvvatlashi 2026-yil 20-avgustda tugagan, hech qanday tuzatish olmadi.
Aprelda ARM64'dagi avvalgi Cranelift sandbox qochishini tuzatish uchun 36.0.7, 42.0.2 yoki 43.0.1 ga yangilangan ARM64 hostlari hali ham CVE-2026-115893 dan ta'sirlangan.
Nima Qilish Kerak
Sizning liniyangiz uchun tuzatilgan relizga yangilang: 36.0.19, 48.0.7 yoki 49.0.4. 20-oktabrda chiqarilgan Wasmtime 50.0.0 ikkala kamchilik uchun ham tuzatilgan. Qo'llab-quvvatlanmaydigan liniyadagi hostlar bu relizlardan biriga o'tishi kerak.
Wasmtime boshqa dasturlarga kutubxona sifatida o'rnatilishi mumkin, shuning uchun buyruq satri vositasini yangilash ularni tuzatmaydi. Wasmtime'ni o'z ichiga olgan har bir dastur tuzatilgan versiya bilan qayta qurilishi kerak.
Hech bir maslahatda vaqtinchalik yechim ro'yxatga olinmagan. Host yangilanmaguncha, xavf tashqi shaxs taqdim etishi mumkin bo'lgan har qanday moduldan keladi.
Ikkala kamchilik ham RustSec'da, ya'ni cargo-audit vositasi Cargo.lock fayllarini tekshirish uchun ishlatadigan ma'lumotlar bazasida, RUSTSEC-2026-0380 va RUSTSEC-2026-0379 sifatida ro'yxatga olingan.
26-oktabr holatiga ko'ra, GitHub'ning maslahat ma'lumotlar bazasida CVE-2026-115889 uchun ko'rib chiqilgan yozuv bor edi, lekin CVE-2026-115893 uchun yo'q. GitHub faqat ko'rib chiqilgan yozuvlar Dependabot ogohlantirishlarini ishga tushirishini aytadi, shuning uchun Dependabot foydalanuvchilari ARM64 kamchiligi uchun ogohlantirish kutmasligi kerak.
Spin, serverless WebAssembly ilovalarini qurish uchun ochiq manbali vosita, Wasmtime'da ishlaydi va 21-oktabrda 4.2.4 versiyasida Wasmtime 50.0.0 ga o'tdi.
Ikkita Kamchilik Qanday Ishlaydi
CVE-2026-115889 Cranelift funksiyadagi qiymatlarni kuzatish uchun ishlatadigan raqamlarni saqlash usulidan kelib chiqadi. 43-versiyadan oldin u bu raqamlarni 24-bitli maydonlarga joylashtirgan va reliz tuzilmalarida maydon uchun juda katta raqam xato bermasdan to'lib ketgan.
Cranelift keyin noto'g'ri qiymatga murojaat qilishi mumkin edi va bu noto'g'ri mashina kodini ishlab chiqarishi mumkin edi. Juda katta WebAssembly funksiyasi yoki ko'p qiymatlardan foydalanish uchun maxsus tayyorlangan funksiya bu orqali tur aralashuvini majburlab, sandbox'dan qochishi mumkin, deb aytiladi maslahatda.
Wasmtime'ning asosiy rivojlanish liniyasi muammoni allaqachon yo'q qilgan edi. 18-fevralda birlashtirilgan o'zgarish maydonlarni 32 bitga kengaytirdi va 20-martda Wasmtime 43.0.0 da chiqarildi. Uning tavsifi uni katta funksiyalarni kompilyatsiya qilish usuli sifatida taqdim etgan va xavfsizlik haqida eslatmagan.
36.x LTS liniyasi xuddi shu o'zgarishni 19-oktabrda oldi. Maslahatda xavfsizlik ta'siri qachon tan olingani aytilmagan.
CVE-2026-115893 br_table bilan bog'liq, bu WebAssembly ko'rsatmasi indeks asosida kodning ko'p joylaridan biriga sakraydi. Jadvaldan tashqaridagi indeks standart maqsadga boradi. ARM64'dagi Cranelift bu diapazondan tashqari indekslarni standart maqsadga faqat taxminan 1 MiB ga yetadigan tarmoq bilan yuborgan.
Taxminan 256 000 dan ortiq maqsadli br_table sakrash jadvalini bu yetish uchun juda katta qilgan, shuning uchun tarmoq jimjit ravishda noto'g'ri joyga ishora qilgan.
ARM64'dagi har qanday Wasmtime dvigateli standart sozlamalar bilan "foydalanuvchi nazorat qiladigan Wasm moduli tomonidan ixtiyoriy kodga sakrashga majburlanishi mumkin", deb aytiladi maslahatda. Xato Wasmtime birinchi marta 2020-yilda ARM64'ni qo'llab-quvvatlaganidan beri mavjud.
Tuzatish diapazondan tashqari indekslarni sakrash jadvali orqali yuboradi, shuning uchun uzoq tarmoq kerak emas. Tuzatilgan versiyalar shuningdek 65 520 dan ortiq maqsadli br_table'ni kompilyatsiya qilishdan bosh tortadi.
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on October 19 and 20, and the maintainers have not reported any attacks.
Wasmtime runs WebAssembly code outside web browsers. Both bugs are in Cranelift, the compiler it uses by default to turn WebAssembly into machine code. Wasmtime's maintainers at the Bytecode Alliance rated each flaw 9.9 out of 10 on the CVSS scale in advisories published on October 19.
- CVE-2026-115889 affects Wasmtime across all processor architectures.
- CVE-2026-115893 affects only ARM64, also called aarch64.
The sandbox is meant to keep a module inside set limits. A module can only use its own memory and the host functions it is given, and its code can only jump to checked locations.
Because both flaws need a module the attacker controls, the risk is highest for services that compile modules written by other people. Fastly, for example, says its Compute platform runs customer code using Wasmtime. The advisories do not name any affected services or specify what an attacker could access after escaping the sandbox.
Neither flaw was in the Known Exploited Vulnerabilities catalog kept by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as of October 26.
Which Versions Are Affected
The two flaws were fixed at different times, so whether your version is affected depends on your release line and, for one flaw, your processor architecture.
| Wasmtime version | CVE-2026-115889 (any architecture) | CVE-2026-115893 (ARM64 only) | What to do |
|---|---|---|---|
| Before 36.0.19 (includes 24.x) | Affected | Affected | Update to 36.0.19, or move to 48.0.7, 49.0.4 or 50.0.0 |
| 36.0.19 | Fixed | Fixed | None needed for these flaws |
| 37.0.0 through 42.x | Affected | Affected | Move to 48.0.7, 49.0.4 or 50.0.0 |
| 43.0.0 through 47.x | Not affected | Affected | Move to 48.0.7, 49.0.4 or 50.0.0 |
| 48.0.0 through 48.0.6 | Not affected | Affected | Update to 48.0.7 |
| 48.0.7 | Not affected | Fixed | None needed for these flaws |
| 49.0.0 through 49.0.3 | Not affected | Affected | Update to 49.0.4 |
| 49.0.4, and 50.0.0 or later | Not affected | Fixed | None needed for these flaws |
Wasmtime supports long-term support (LTS) releases, which are numbered in multiples of 12, for two years. Other releases get two months. Security fixes are guaranteed for supported releases.
Only the 36, 48, 49, and 50 release lines are still supported. Every other line, including the 24.x LTS line whose support ended on August 20, 2026, got no fix.
ARM64 hosts that updated to 36.0.7, 42.0.2, or 43.0.1 in April to fix an earlier Cranelift sandbox escape on ARM64 are still affected by CVE-2026-115893.
What to Do
Update to the fixed release for your line: 36.0.19, 48.0.7, or 49.0.4. Wasmtime 50.0.0, released on October 20, is fixed for both flaws. Hosts on an unsupported line need to move to one of these releases.
Wasmtime can be built into other programs as a library, so updating the command-line tool does not fix them. Each program that includes Wasmtime needs to be rebuilt with a fixed version.
Neither advisory lists a workaround. Until a host is updated, the risk comes from any module an outsider can supply.
Both flaws are listed in RustSec, the database the cargo-audit tool uses to check Cargo.lock files, as RUSTSEC-2026-0380 and RUSTSEC-2026-0379.
As of October 26, GitHub's advisory database had a reviewed entry for CVE-2026-115889 but none for CVE-2026-115893. GitHub says only reviewed entries trigger Dependabot alerts, so Dependabot users should not expect an alert for the ARM64 flaw.
Spin, an open-source tool for building serverless WebAssembly apps that runs on Wasmtime, moved to Wasmtime 50.0.0 in version 4.2.4 on October 21.
How the Two Flaws Work
CVE-2026-115889 comes from how Cranelift stored the numbers it uses to track values inside a function. Before version 43, it packed these numbers into 24-bit fields, and in release builds, a number too large for its field overflowed without any error.
Cranelift could then refer to the wrong value, producing incorrect machine code. A very large WebAssembly function, or one crafted to use many values, can use this to force type confusion and escape the sandbox, according to the advisory.
Wasmtime's main development line had already removed the problem. A change merged on February 18 widened the fields to 32 bits and shipped in Wasmtime 43.0.0 on March 20. Its description presented it as a way to compile larger functions and did not mention security.
The 36.x LTS line got the same change on October 19. The advisory does not say when the security impact was recognized.
CVE-2026-115893 involves br_table, a WebAssembly instruction that jumps to one of many places in the code based on an index. An index outside the table goes to a default target. On ARM64, Cranelift sent these out-of-range indexes to the default with a branch that can only reach about 1 MiB.
A br_table with more than about 256,000 targets made the jump table too big for that reach, so the branch silently pointed to the wrong place.
Any Wasmtime engine on ARM64 with default settings "can be forced to jump to arbitrary code by a user-controlled Wasm module," the advisory says. The bug has been present since Wasmtime first supported ARM64 in 2020.
The fix sends out-of-range indexes through the jump table itself, so no long branch is needed. Fixed versions also refuse to compile a br_table with more than 65,520 targets.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.