Low Severity
CVE-2026-115889
Published: Oct 31, 2026
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
# CVE-2026-115889
Offline Python version-exposure detector for Wasmtime's Cranelift SSA value-index
packing vulnerability. Processes an individual runtime version or a CSV/JSON
inventory, preserves evidence hashes, and reports affected, unaffected or unknown
results without compiling or executing WebAssembly.
**Scope:** release classification, not an exploitability or compromise test. The
tool does not inspect engine configuration, compiler backend selection, build
flags, compiled artifacts, or deployed binary provenance. Its JSON reports state
`configuration_assessed: false`.
## Technical basis
Sources reviewed on **2026-10-29**:
- [Upstream advisory GHSA-897f-g5gm-fmxm](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm).
- [CNA record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115889.json), snapshot updated 2026-10-26T17:42:15.319Z.
The advisory describes numeric truncation in packed SSA indices in Cranelift,
leading to incorrect intermediate-representation references and miscompilation.
The described impact includes possible sandbox escape when compiling specially
crafted modules with the default Cranelift backend. The record lists CWE-197 and
CWE-843, with CVSS v3.1 score 9.9. It identifies fixes in 36.0.19 and 43.0.0.
| Inclusive lower bound | Exclusive upper bound | Version status |
| --- | --- | --- |
| 0.0.0 | 36.0.19 | affected |
| 37.0.0 | 43.0.0 | affected |
Zero normalizes the unbounded lower range for stable numeric versions; it is not
a claim that a 0.0.0 release exists. The separate ranges matter: 36.0.19 is fixed,
but 37.0.0 remains affected. A global comparison against 43.0.0 would misclassify
the backport. The upstream advisory metadata lists 36.0.19 as patched and its
narrative explains the v43 correction; the CNA explicitly lists both boundaries.
The bundled rules are an authored extraction, not a full upstream record snapshot.
Source URLs may change, and rule