Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

# Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

https://gcdradar.vercel.app/incidents/two-critical-wasmtime-flaws-could-let-malicious-webassembly · AIR-2026-1529 · closed 2026-11-09

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical vulnerability rated by maintainers with patches released.
- Fix status: Patched
- First reported: 2026-10-26
- AI role: No AI role
- Products: Wasmtime
- CVSS: 9

## Summary

Two critical flaws in the Wasmtime WebAssembly runtime allow malicious modules to escape their intended sandboxes. Attackers require a vulnerable build to compile a controllable module, with one issue specifically affecting ARM64 systems.

## What to do

Update Wasmtime to the latest patched releases provided by maintainers.

## Affected and fixed versions

- Affected: Wasmtime
- Fixed in: Wasmtime fixed versions

## Latest updates

- 2026-10-26: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes (https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html)

## Sources

- 2026-10-26 The Hacker News: Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.