Wasmtime Hit by Two CVSS 9.9 Sandbox Escape Flaws

Wasmtime, a WebAssembly runtime, disclosed two critical sandbox escape vulnerabilities rated CVSS 9.9, both rooted in its default Cranelift compiler; one affects only ARM64. Patched releases are now available from the Bytecode Alliance.

2026-10-26 ~ 2026-10-27 · 2 related posts

• Two critical Wasmtime flaws (CVSS 9.9) let malicious Wasm modules escape sandboxes — jedisct1 · 2026-10-26
• Two CVSS 9.9 Wasmtime flaws allow sandbox escape, one ARM64-only since 2020 — basedjensen · 2026-10-27