{"id":"CVE-2026-115383","kind":"vulnerability","aliases":["CVE-2026-115383"],"related":[],"title":"Wasmtime: crafted components corrupt GC heap and crash the runtime","description":"Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.","summary":"Wasmtime versions 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 accept components whose core modules import WebAssembly tags with a subtype of the original type. A malicious guest can mis-type exception payloads to corrupt the garbage-collected heap, causing Wasmtime to panic when the exceptions proposal is enabled.","severity":"medium","cvss":5.9,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["plugin-hosts","runtime","rust","wasm","wasmtime"],"not_affected_if":["exceptions-proposal-disabled","trusted-guests-only"],"how_to_check":"- Run `wasmtime --version` and check whether it is between `47.0.0` and `48.0.4`, or between `49.0.0` and `49.0.2`.\n- Check whether the embedding enables the WebAssembly exceptions proposal (unknown whether the sources name the exact setting).","fix":"- Upgrade Wasmtime to `48.0.4` or later on the 48 line, or `49.0.2` or later on the 49 line.","status":"open","published_at":"2026-10-22T19:17:45+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:07:57+00:00","updated_at":"2026-10-25T04:07:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:07:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wasmtime to `48.0.4` or later on the 48 line, or `49.0.2` or later on the 49 line.","reach":"unknown","title":"Wasmtime: crafted components corrupt GC heap and crash the runtime","impact":"medium","summary":"Wasmtime versions 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 accept components whose core modules import WebAssembly tags with a subtype of the original type. A malicious guest can mis-type exception payloads to corrupt the garbage-collected heap, causing Wasmtime to panic when the exceptions proposal is enabled.","category":"runtime","nicknames":[],"who_cares":["wasmtime","wasm","plugin-hosts","rust"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Malicious guest crashes host process via GC heap corruption","analyst_note":"Confirm from the Wasmtime security advisory whether the exceptions proposal is enabled by default and what the attack requires from the guest; the NVD entry alone does not say.","how_to_check":"- Run `wasmtime --version` and check whether it is between `47.0.0` and `48.0.4`, or between `49.0.0` and `49.0.2`.\n- Check whether the embedding enables the WebAssembly exceptions proposal (unknown whether the sources name the exact setting).","needs_analyst":true,"not_affected_if":["trusted-guests-only","exceptions-proposal-disabled"],"who_is_affected":"Teams that run Wasmtime to execute untrusted WebAssembly components, particularly with the exceptions proposal enabled. Hosts that only run their own trusted modules, or that run Wasmtime versions outside the listed ranges, are not affected by this description. The sources do not say whether the exceptions proposal is on by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":3405,"output_tokens":676,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115383':13A,16A '-2026':12A,15A '47.0.0':26B,75C '48.0.4':28B,77C '49.0.0':30B,79C '49.0.2':32B,81C 'accept':33B,88C 'caus':64B,117C 'collect':62B 'compon':3A,34B,89C 'contain':82C 'core':36B,91C 'corrupt':4A,58B,113C 'craft':2A 'crash':8A 'cve':11A,14A 'enabl':73B,126C 'except':55B,70B,109C,123C 'garbag':61B 'garbage-collect':60B 'gc':5A,115C 'guest':50B,104C 'heap':6A,63B,116C 'host':19B 'import':38B,93C 'improp':84C 'malici':49B,103C 'mis':53B,107C 'mis-typ':52B,106C 'modul':37B,92C 'object':110C 'origin':46B,101C 'panic':67B,120C 'payload':56B,111C 'plugin':18B 'plugin-host':17B 'propos':71B,124C 'runtim':10A,20B 'rust':21B 'subtyp':43B,98C 'tag':40B,95C 'type':47B,54B,102C,108C 'valid':85C 'version':25B 'vulner':86C 'wasm':22B 'wasmtim':1A,23B,24B,65B,74C,118C 'webassembl':39B,94C 'whose':35B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Wasmtime to execute untrusted WebAssembly components, particularly with the exceptions proposal enabled. Hosts that only run their own trusted modules, or that run Wasmtime versions outside the listed ranges, are not affected by this description. The sources do not say whether the exceptions proposal is on by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115383","severity":null,"published_at":"2026-10-22T19:17:45+00:00","modified_at":"2026-10-22T19:17:45+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115383","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115383","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}