Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1094 _____________________________________________________________________ DATE : 28/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running wasmtime (Rust) versions prior to 36.0.19, 48.0.7, 49.0.4. ==================================================================== https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm _____________________________________________________________________ Bit-packing in Cranelift compiler causes silent overflow and miscompilation This report was submitted with AI assistance Critical pchickey published GHSA-897f-g5gm-fmxm Package wasmtime (Rust) Affected versions <36.0.19, >= 37.0.0, <43.0.0 Patched versions 36.0.19 Description Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox. Cranelift was changed in Wasmtime v43 to use a full u32 index, with checks if that limit is exceeded, and so is no longer susceptible to this bug. Impact A Wasmtime engine with default settings (using the Cranelift backend) on any architecture/platform could experience a sandbox escape from a specially-crafted Wasm module. Patches Wasmtime v36.0.19 has been released which fixes this issue. Severity Critical 9.9/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE ID CVE-2026-115889 Weaknesses Weakness CWE-197 Weakness CWE-843 Credits @jaydns jaydns Reporter __________________________________________________________________ Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction Critical pchickey published GHSA-mghf-wjfp-p5xm Package wasmtime (Rust) Affected versions <36.0.19, >=37.0.0, <48.0.7, >=49.0.0, <49.0.4 Patched versions 36.0.19, 48.0.7, 49.0.4 Description Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one br_table instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to arbitrary other code (at an user-controlled offset), leading to arbitrary sandbox escapes. Impact Any Wasmtime engine running on aarch64 with default settings can be forced to jump to arbitrary code by a user-controlled Wasm module. All versions of Wasmtime/Cranelift that support aarch64, since the initial release of that support in 2020 (before Wasmtime v1.0), are affected. Patches Wasmtime v36.0.19, v48.0.7, and v49.0.4 have been released which all fix this issue. Severity Critical 9.9/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE ID CVE-2026-115893 Weaknesses Weakness CWE-691 Credits @ilyas-mallah ilyas-mallah Reporter _____________________________________________________________________ Vulnerabilities Resolved in Veeam ONE 13.1 P1 KB ID: 4951 Product: Veeam ONE | 13.1 Published: 2026-10-27 Last Modified: 2026-10-27 Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program (VDP) for all Veeam products and perform extensive internal code audits. When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information. This approach ensures that all potentially affected customers can quickly implement the necessary measures to safeguard their systems. It’s important to note that once a vulnerability and its associated patch are disclosed, attackers will likely attempt to reverse-engineer the patch to exploit unpatched deployments of Veeam software. This reality underscores the critical importance of ensuring that all customers use the latest versions of our software and install all updates and patches without delay. Issue Details CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification. Severity: High CVSS v4.0 Score: 8.5 Source: Reported through HackerOne. Affected Product Veeam ONE 13.1.0.7233 and all earlier version 13.1 builds. Note: Older versions (e.g., 13.0.x and 12.x) are not affected. Solution This vulnerability was fixed starting in the following build: Veeam ONE 13.1 P1 (build 13.1.0.7940) If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter. ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================