Homepage

Numeric Truncation Error Affecting rust-wasmtime package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-RUSTWASMTIME-21664619
  • published24 Oct 2026
  • disclosed23 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Oct 2026

NewCVE-2026-115889  (opens in a new tab)
CWE-197  (opens in a new tab)
CWE-843  (opens in a new tab)

How to fix?

There is no fixed version for Debian:13 rust-wasmtime.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rust-wasmtime package and not the rust-wasmtime package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.