Two critical vulnerabilities in Wasmtime, a WebAssembly runtime, could allow malicious modules to escape their intended sandboxes, affecting services that compile user-generated code.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-115889 | 9.9 | CRITICAL | No | - |
| CVE-2026-115893 | 9.9 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers (2026-10-25)
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (2026-10-24)
- Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws (2026-10-23) - The Hacker News
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances (2026-10-23)
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (2026-10-22)
Business impact
Organizations using Wasmtime in services that compile user code face risks, as attackers could potentially gain unauthorized access to resources.
Industries affected
The impact is significant for industries relying on WebAssembly, particularly cloud services and content delivery networks.
Users affected
Users of services that compile and run WebAssembly modules, such as Fastly’s Compute platform, should update to fixed versions to mitigate risks.
