Two severe 9.9-rated flaws have been found in Wasmtime's Cranelift compiler.
CVE-2026-115889 impacts all architectures, while CVE-2026-115893 affects ARM64 systems.
Fixed versions are available across multiple release lines.
The problems lie in the internal part of the software that translates the code so that it can be executed by the computer. The first issue affects systems regardless of their processor type, while the second concerns only systems based on ARM64 processors. In order to exploit the gaps, someone needs to have control over the program that is currently running.
Who is most at risk?
The risk is greater for services that undertake to translate and run code originating from external users or customers, as is the case, for example, with the Fastly Compute service.
So far, the software creators have no reports of actual attacks exploiting these gaps, while the problems are not even included in the authorities' official lists of actively exploited vulnerabilities.
What should administrators do?
The developers released fixed versions on October 19 and 20. The safe versions include the 36.0.19, 48.0.7, 49.0.4, and 50.0.0 series or later.
READ ALSO
New PHP packages for Windows fix serious security flaw
Because this software is usually embedded within other programs, a simple file update is not enough. Every program that uses it must be rebuilt and recompiled from scratch with the new, corrected version.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)