Live › vulnerability › CVE-2026-115383
Go to dashboardWasmtime versions 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 accept components whose core modules import WebAssembly tags with a subtype of the original type. A malicious guest can mis-type exception payloads to corrupt the garbage-collected heap, causing Wasmtime to panic when the exceptions proposal is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Wasmtime to execute untrusted WebAssembly components, particularly with the exceptions proposal enabled. Hosts that only run their own trusted modules, or that run Wasmtime versions outside the listed ranges, are not affected by this description. The sources do not say whether the exceptions proposal is on by default.
No product ranges from the sources yet.
wasmtime --version and check whether it is between 47.0.0 and 48.0.4, or between 49.0.0 and 49.0.2.48.0.4 or later on the 48 line, or 49.0.2 or later on the 49 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-115383")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.