NewsThe Hacker News
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
More on WebAssembly
Other advisories
- MediumCVE-2026-113680HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
- HighCVE-2026-113679HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
- Not ratedosv:CLEANSTART-2026-MJ23189Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
- Not ratedosv:CVE-2026-113680HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
- Not ratedosv:CVE-2026-113679HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
- CriticalCVE-2026-115889Wasmtime: two critical Cranelift miscompilation bugs let a malicious WebAssembly module escape the sandbox (CVE-2026-115889, CVE-2026-115893)
- Not ratedosv:RUSTSEC-2026-0410WebAssembly allocator shim corrupts memory on allocation failure
- HighCVE-2026-102870nuget Microsoft.AspNetCore.Components.WebAssembly.Server: Code-Injection
Source: https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html
ID