PkgSeer

Vulnerability RUSTSEC-2026-0379

Critical

1 day ago

Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

0.0.0 - 36.0.18 and 37.0.0 - 48.0.6 and 49.0.0 - 49.0.3

Summary

Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm For more information see the GitHub-hosted security advisory.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Panic lowering a host-created component model stream into a guest that expects a different payload type

46.0.0 - 48.0.6 and 49.0.0 - 49.0.3 RUSTSEC-2026-0378

Bit-packing in Cranelift compiler causes silent overflow and miscompilation

0.0.0 - 36.0.18 and 37.0.0 - 42.0.2 RUSTSEC-2026-0380

Panic when invoking an async-lifted function via `call`

46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0353

Host panic when component `call_async` is cancelled under some conditions

46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0354

Panic viewing component model stream or future as the wrong type

46.0.0 - 48.0.5 and 49.0.0 - 49.0.2 RUSTSEC-2026-0355

View all vulnerabilities for these packages

Impacted packages

wasmtime

Timeline

Published

1 day ago

Fixed (36.0.19)

22 hours ago

Fixed (49.0.4)

21 hours ago

Fixed (48.0.7)

21 hours ago

Last Modified

5 hours ago