Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-115892EUVD-2026-109187RUSTSEC-2026-0378GHSA-9PVW-HWFG-92H5

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 48.0.7, 49.0.4
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Wasmtime, a WebAssembly runtime, is affected when it handles host-created component-model streams and futures passed into guest code. A malicious guest can trigger a panic that crashes the host application.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  4. Record last updated

Affected versions

  • bytecodealliance wasmtime

    From 46.0.0 · fixed in 48.0.7; From 49.0.0 · fixed in 49.0.4

  • wasmtimecrates.io

    From 46.0.0 · fixed in 48.0.7; From 49.0.0 · fixed in 49.0.4

  • wasmtimecrates.io

    From 46.0.0 · fixed in 48.0.7

  • wasmtimecrates.io

    From 49.0.0 · fixed in 49.0.4

References 9

GitHub · bytecodealliance/wasmtime