Live › vulnerability › CVE-2026-115379
Go to dashboardWasmtime, the WebAssembly runtime, fails to root some references across a try_call when compiling Wasm modules, so a garbage collection can leave them stale or dangling. An attacker who supplies a crafted Wasm module can cause GC heap corruption or incorrect execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that embed Wasmtime on versions 47.0.0 through 48.0.3 or 49.0.0 through 49.0.1 and compile Wasm modules they did not write, such as plugins, user uploads or third-party modules. Teams that run only trusted, self-authored Wasm, or use other Wasm runtimes, have less exposure. Versions outside these ranges are not listed as affected.
No product ranges from the sources yet.
wasmtime --version (or check the wasmtime crate version in Cargo.lock) and see whether it falls in 47.0.0 to before 48.0.4, or 49.0.0 to before 49.0.2.48.0.4 or later on the 48.x line, or to 49.0.2 or later on the 49.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-115379")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.