A Rust package finding is a starting point. The decision that matters is whether an affected Wasmtime runtime actually compiles untrusted WebAssembly.
New Microsoft applicability — October 29, 2026. MSRC added Azure Linux 3.0 records for CVE-2026-115889 (01:13:22 UTC) and CVE-2026-115893 (01:13:07 UTC). These are new Microsoft mappings, not new upstream disclosures: the Bytecode Alliance advisories are dated October 19; their CNA records were published October 23. Both upstream advisories and Microsoft rate the issues Critical, CVSS 3.1 9.9.
Check the runtime and trust boundary
The first issue can miscompile a specially crafted, very large Wasm function through overflowing packed compiler indices, allowing sandbox escape on any architecture using Cranelift. The second can compile an aarch64 Wasm branch table with more than approximately 256,000 targets into an incorrect jump, also allowing sandbox escape. Both require attacker-controlled Wasm reaching an affected compiler/runtime; this does not establish ordinary internet exposure for every Azure Linux or Rust installation.
Microsoft lists azl3 rust 1.75.0-31 and 1.96.1-2 on Azure Linux 3.0. Its fixed-build and download fields are blank. Those package rows are not a complete affected Wasmtime version matrix and are not proof that every Rust application embeds Wasmtime. Verify Cargo.lock/SBOM, embedded or statically linked libraries, actual loaded runtime, backend, architecture and whether tenants or other untrusted users can supply modules. No Microsoft-managed Azure service or Windows Hyper-V impact is established by these records.
Verified upstream affected and fixed versions
| ID | Affected runtime / prerequisite | Upstream fix |
|---|---|---|
| CVE-2026-115889 | Wasmtime <36.0.19, or ≥37.0.0 and <43.0.0; default Cranelift backend, any architecture | 36.0.19; 43.0.0 and later no longer use the vulnerable packing |
| CVE-2026-115893 | Wasmtime <36.0.19, or ≥37.0.0 and <48.0.7, or ≥49.0.0 and <49.0.4; aarch64 + Cranelift | 36.0.19, 48.0.7 or 49.0.4 for the matching maintained branch |
For a compatible deployment needing closure for both CVEs, the verified branch targets are 36.0.19, 48.0.7 or 49.0.4. Validate the supported upgrade path and other security requirements; do not downgrade to these versions. Upstream runtime fixes are not Azure Linux RPM or AKS node-image mappings. Azure Linux fixed package/image availability is not verified here.
MSP action
Suggested priority: high if affected engines accept untrusted Wasm. Inventory actual runtimes and build dependencies across applicable Azure Linux workloads, containers, build agents and hosted extension systems → as an MSP precaution, suspend untrusted module submission/execution where affected until a safe rollout is available → update the matching upstream dependency through a supported application build or obtain Microsoft’s confirmed package target; rebuild and redeploy statically linked applications/images and restart affected processes → verify the running dependency, backend/architecture, isolation configuration and workload health. An OS update or Rust toolchain version alone is not closure.
No complete vendor workaround is published in the two upstream advisories reviewed. The temporary admission restriction above is suggested containment, not a vendor-certified substitute for patching. No mandatory credential rotation or incident-response procedure was verified for these CVEs; investigate suspicious activity according to the environment.
Exploitation and limits
No active-exploitation claim was verified in the reviewed official material. MSRC does not supply a usable exploitation-status field for these records; do not interpret that omission as confirmation of no exploitation. Neither CVE appears in the full CISA KEV catalog 2026.10.28 (1,762 records), checked October 29. No KEV federal deadline applies. Customer use, exposure and compromise are not assumed.
Official sources
MSRC October CVRF data · MSRC CVE-2026-115889 · MSRC CVE-2026-115893
Bytecode Alliance: compiler index overflow · Bytecode Alliance: aarch64 branch target · Microsoft Azure Linux upgrade guidance · Official CISA KEV data
Last verified: October 29, 2026. Package-specific fixes and customer applicability remain independent validation steps.