Two Critical Wasmtime Vulnerabilities Enable WebAssembly Sandbox Escape
CVE-2026-#### and CVE-2026-#### affect WebAssembly runtime; one flaw architecture-specific to ARM64
Key Takeaways
- Two critical Wasmtime vulnerabilities disclosed on 2026-10-26 allow sandbox escape via malicious WebAssembly modules.
- One flaw is specific to ARM64 architecture; the other affects broader platforms.
- Fixed versions were released on the same day as disclosure.
- Users should update Wasmtime to the latest version to apply the patches.
- No public exploit code is confirmed as of disclosure.
Quick answers
- What happened?
- Two critical security vulnerabilities in the Wasmtime WebAssembly runtime have been disclosed, potentially allowing malicious modules to escape their intended sandboxes. One flaw affects ARM64 systems specifically, while the other impacts broader platforms. Fixed versions were released on October 26, 2026.
- Which products are affected?
- Wasmtime WebAssembly runtime
- What should defenders do?
- Update to the latest Wasmtime version. Fixed versions were released on 2026-10-26. Monitor official Wasmtime security advisories for complete CVE numbers and technical details.
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say.
An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on 2026-10-26.
The vulnerabilities arise from improper validation of WebAssembly instructions during execution. Successful exploitation could allow a malicious WebAssembly module to escape its sandbox, potentially leading to unauthorized access to host system resources, data exfiltration, or further compromise of the host application. One flaw is specific to the ARM64 architecture.
Users are advised to update to the latest Wasmtime version to mitigate the vulnerabilities. As of the disclosure date, no public exploit code has been confirmed.
Security Details
The vulnerabilities stem from improper validation of WebAssembly instructions during execution in the Wasmtime runtime. One flaw is specific to ARM64 systems, while the other impacts broader platforms. Successful exploitation could allow a malicious WebAssembly module to escape its sandbox boundary.
Affected products
Wasmtime WebAssembly runtime
Mitigation
Update to the latest Wasmtime version. Fixed versions were released on 2026-10-26. Monitor official Wasmtime security advisories for complete CVE numbers and technical details.
Sources
The Hacker News
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Oct 26, 2026 · 11:52
Original link
Related Security News
Multiple Critical RCE Vulnerabilities and Supply-Chain Incident Reported in Weekly Recap
A weekly cybersecurity recap highlights the emergence of multiple critical remote code execution vulnerabilities across various platforms, with active scanning and exploitation observed. Additionally, a software supply-chain incident was reported following the leakage of a signing key, raising compromise risks for downstream users.
