Live › vulnerability › CVE-2026-119133
Wasmtime, a WebAssembly runtime, has a memory layout flaw: a module with an odd number of exception tags misaligns later host fields when exceptions are enabled, causing undefined behavior. The sources say no exploitation path is currently known, so the realistic worst case is a crash or unpredictable behavior rather than confirmed code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime with WebAssembly exceptions enabled and load modules that define tags. Embedders that do not enable exceptions, or that run only trusted modules, have lower exposure. Teams on Wasmtime 47.x or 49.0.x before the fixed patches should review their version.
No product ranges from the sources yet.
48.0.6 on the 48.x line, or 49.0.3 on the 49.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.
This page as .md · .json · in your agent: get_signal("CVE-2026-119133")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.