CVE-2026-115892
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.
- CVSS 4.0
- 5.7
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-248, CWE-843
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9pvw-hwfg-92h5 | crates.io | wasmtime | >=46.0.0 <48.0.7 | 48.0.7 |
| GHSA-9pvw-hwfg-92h5 | crates.io | wasmtime | >=49.0.0 <49.0.4 | 49.0.4 |
| RUSTSEC-2026-0378 | crates.io | wasmtime | >=46.0.0 <48.0.7 >=49.0.0 <49.0.4 | 48.0.7, 49.0.4 |
References
- https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
- https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
- https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
- https://github.com/bytecodealliance/wasmtime/pull/14819
- https://github.com/bytecodealliance/wasmtime/pull/14820