Two severe 9.9-rated flaws have been found in Wasmtime's Cranelift compiler.

CVE-2026-115889 impacts all architectures, while CVE-2026-115893 affects ARM64 systems.

Fixed versions are available across multiple release lines.

The problems lie in the internal part of the software that translates the code so that it can be executed by the computer. The first issue affects systems regardless of their processor type, while the second concerns only systems based on ARM64 processors. In order to exploit the gaps, someone needs to have control over the program that is currently running.

Who is most at risk?

The risk is greater for services that undertake to translate and run code originating from external users or customers, as is the case, for example, with the Fastly Compute service.

So far, the software creators have no reports of actual attacks exploiting these gaps, while the problems are not even included in the authorities' official lists of actively exploited vulnerabilities.

What should…