Two CVSS 9.9 Wasmtime flaws allow sandbox escape, one ARM64-only since 2020
basedjensen · x · 2026-10-27
The Hackers News reports two critical vulnerabilities in the Wasmtime WebAssembly runtime, both in its default Cranelift compiler, that could let malicious Wasm modules escape the sandbox. The Bytecode Alliance rated both CVSS 9.9: CVE-2026-115889 affects all architectures, while CVE-2026-115893 is ARM64-only and has existed since 2020. Exploitation requires compiling attacker-controlled modules, so services running other people's code (e.g. Fastly Compute) are most at risk. Fixed versions shipped Oct 19-20; no attacks reported and neither bug is in CISA's KEV catalog. Apps embedding Wasmtime need rebuilding.
Related event: Wasmtime Hit by Two CVSS 9.9 Sandbox Escape Flaws(2 posts)→
More from Infra
- PyTorch details 2.12x faster on-device streaming ASR on Arm SME2 via ExecuTorch — PyTorch · 2026-10-27
- Revenue per GPU can rise as token prices fall, argues Gavin Baker — GavinSBaker · 2026-10-27
- Anthropic S-1: only $19B total compute spend since inception, overbuild warning — bookwormengr · 2026-10-27
- CoreWeave, You.com and NVIDIA lift BrowseComp 22.9% in 3-week RL post-training sprint — RichardSocher · 2026-10-27
- Grid queues make power architecture an AI-factory decision; Exowatt and Redwood offer fixes — ingliguori · 2026-10-27
- AI Infra Meme: While Countries Need TW-Scale Power for Datacenters, People Argue About Lightbulbs — mgostIH · 2026-10-27