Wasmtime's sandbox did not fail. The compiler that builds it overflowed a counter without saying anything
2026-10-27Security
CVE-2026-115889 is a 9.9 in Cranelift, where bit-packed value indices overflow silently in release builds. The result is arbitrary miscompilation and a sandbox escape, on default settings, with no workaround.