---
id: "CVE-2026-115379"
kind: "vulnerability"
aliases: ["CVE-2026-115379"]
title: "Wasmtime: missing GC rooting lets crafted Wasm corrupt the GC heap"
severity: "medium"
cvss: 6.9
epss: 0.00277
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["plugins", "runtime", "rust", "wasmtime", "webassembly"]
not_affected_if: ["other-runtime", "trusted-modules-only"]
published_at: "2026-10-22T19:17:44+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115379", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115379", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Wasmtime: missing GC rooting lets crafted Wasm corrupt the GC heap

Wasmtime, the WebAssembly runtime, fails to root some references across a try_call when compiling Wasm modules, so a garbage collection can leave them stale or dangling. An attacker who supplies a crafted Wasm module can cause GC heap corruption or incorrect execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `wasmtime --version` (or check the wasmtime crate version in Cargo.lock) and see whether it falls in 47.0.0 to before 48.0.4, or 49.0.0 to before 49.0.2.
- Check whether the application runs untrusted or user-supplied Wasm modules through Wasmtime.

## Fix

- Upgrade Wasmtime to `48.0.4` or later on the 48.x line, or to `49.0.2` or later on the 49.x line.
- Upgrade the Wasmtime crate or binary in each service that embeds it.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115379
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115379

## From the sources

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_