CVE-2026-119132RUSTSEC-2026-0360GHSA-54P9-VHHQ-8F7Q
Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 49.0.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Wasmtime, a runtime for executing WebAssembly components, is affected by this vulnerability. A malicious WebAssembly guest can crash the host process through a specially crafted string transfer, causing a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- bytecodealliance wasmtime
From 49.0.0 · fixed in 49.0.3
- wasmtimecrates.io
From 49.0.0 · fixed in 49.0.3