CVE-2026-115892
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
36/100
Published: 2026-10-23
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
High
UI:
Passive
S:
X
AT:
Present
VC:
None
VI:
None
VA:
High
Description
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| bytecodealliance | wasmtime | >= 46.0.0, < 48.0.7 |
| bytecodealliance | wasmtime | >= 49.0.0, < 49.0.4 |