lee1981 (@lee1981b) on X

What it is

CyberForge CVE of the Day #087 covers CVE-2026-115889, a Cranelift miscompilation bug in Bytecode Alliance Wasmtime. Identifiers are GHSA-897f-g5gm-fmxm and RUSTSEC-2026-0380. The vendor rates it CVSS v3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and lists CWE-197 and CWE-843. NVD is deferred and carries the GitHub score as secondary. The reporter is credited as jaydns, and the advisory marks the report as AI-assisted.

How it works

Cranelift bit-packs value identities. In sufficiently large, crafted functions an index can overflow silently, with no check in release builds. The compiler then uses the wrong value and emits native code that differs from the Wasm program's meaning. The vendor names arbitrary miscompilation, type confusion and possible sandbox escape.

Module::validate does not clear this flaw. It checks validity for the engine configuration, not whether the compiler translates a valid input correctly. Compilation can also happen ahead of execution through precompiled or serialized artifacts, so a separate build worker may be the vulnerable component.

Preconditions / Affected

• Affected: versions below 36.0.19, and 37.0.0 up to but excluding 43.0.0.
• Fixed: 36.0.19 (released 19 October 2026) within 36.x, and 43.0.0 (released 20 March) for the newer line. RustSec expresses the fixed ranges as at least 36.0.19 but below 37.0.0, or at least 43.0.0.
• The default Cranelift backend is affected on all architectures and platforms.
• An attacker needs a route to get controlled Wasm into compilation. PR:L is kept, so the page says blanket unauthenticated RCE is unsupported.
• Debian's tracker still marked its trixie and forky/sid rust-wasmtime packages vulnerable at the page's cutoff.

What to do

• Compare each version against both intervals. "36.0.19 or later" is unsafe: a 40.x install is still vulnerable.
• Get the resolved dependency record (Cargo.lock, not Cargo.toml ranges), build provenance and the running image digest. Include nested and embedded copies, workers and replicas.
• Map every route where a customer, tenant, plugin supplier or build job supplies Wasm, and the backend in use.
• Until patched, restrict untrusted admission and queues and reduce compiler-host authority. The page says this is a CyberForge measure and that no complete vendor workaround was verified.
• Upgrade and rebuild the embedding application, then confirm the fixed build in running processes. Regenerate compiled artifacts under the owner's compatibility procedure, and do not label old artifacts as rebuilt without evidence.
• For investigation, preserve module digests, job IDs, compiler build and host telemetry. Trace module digest, build job, compiled artifact, runtime, then host telemetry. Escalate on unexplained host-side process, file, credential or network activity tied to untrusted modules.

Caveats

• No active exploitation or verified public PoC was found in the reviewed sources. Public patches and technical descriptions exist.
• CISA KEV has no match (catalogue version 2026.10.23, 1,756 entries). EPSS is 0.454% (39.134th percentile, 25 October 2026).
• The SOC checks are CyberForge's, not vendor-certified signatures. There is no IOC list, event ID or size threshold.
• Fuel, epoch interruption and memory or time limits are not documented fixes.
• The 36.0.19 release bundles other security fixes (br_table, wasi-http) that are separate from this CVE.
• Silent miscompilation need not crash, so a missing crash does not clear a system.