Live › vulnerability › CVE-2026-119132
Wasmtime from 49.0.0 before 49.0.3 panics the host when a WebAssembly guest transfers a string whose source and destination overlap during a same-instance component call. The result is a denial of service: the host process crashes instead of raising a trap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams that embed Wasmtime to run WebAssembly components, especially where guest code is untrusted, such as plugin systems or multi-tenant runtimes. Exposure depends on the component-model fused adapter path with aliasing strings; applications that run only trusted modules are lower risk.
No product ranges from the sources yet.
49.0.0 up to but not including 49.0.3.49.0.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.
This page as .md · .json · in your agent: get_signal("CVE-2026-119132")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.