{"id":"CVE-2026-119133","kind":"vulnerability","aliases":["CVE-2026-119133"],"related":[],"title":"Wasmtime: odd exception tag count misaligns host memory, undefined behavior","description":"Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.","summary":"Wasmtime, a WebAssembly runtime, has a memory layout flaw: a module with an odd number of exception tags misaligns later host fields when exceptions are enabled, causing undefined behavior. The sources say no exploitation path is currently known, so the realistic worst case is a crash or unpredictable behavior rather than confirmed code execution.","severity":"low","cvss":2.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedders","runtime","wasmtime","webassembly"],"not_affected_if":["exceptions-disabled","trusted-modules-only","wasmtime-not-used"],"how_to_check":"- Check the Wasmtime version in your build or lockfile; affected versions are 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3.\n- Check whether your embedder enables WebAssembly exception handling (the exceptions feature) when loading modules.","fix":"- Move to `48.0.6` on the 48.x line, or `49.0.3` on the 49.x line.","status":"open","published_at":"2026-10-29T16:18:06+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:32:11+00:00","updated_at":"2026-10-29T16:32:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-29T16:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `48.0.6` on the 48.x line, or `49.0.3` on the 49.x line.","reach":"unknown","title":"Wasmtime: odd exception tag count misaligns host memory, undefined behavior","impact":"low","summary":"Wasmtime, a WebAssembly runtime, has a memory layout flaw: a module with an odd number of exception tags misaligns later host fields when exceptions are enabled, causing undefined behavior. The sources say no exploitation path is currently known, so the realistic worst case is a crash or unpredictable behavior rather than confirmed code execution.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["wasmtime","webassembly","embedders"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"undefined behavior in host runtime, possibly crash or memory corruption","analyst_note":"","how_to_check":"- Check the Wasmtime version in your build or lockfile; affected versions are 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3.\n- Check whether your embedder enables WebAssembly exception handling (the exceptions feature) when loading modules.","plain_action":"","needs_analyst":false,"not_affected_if":["exceptions-disabled","wasmtime-not-used","trusted-modules-only"],"who_is_affected":"Applications that embed Wasmtime with WebAssembly exceptions enabled and load modules that define tags. Embedders that do not enable exceptions, or that run only trusted modules, have lower exposure. Teams on Wasmtime 47.x or 49.0.x before the fixed patches should review their version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000727,"input_tokens":4176,"output_tokens":618,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119133':13A,16A '-2026':12A,15A '47.0.0':76C '48.0.6':78C '49.0.0':80C '49.0.3':82C 'although':121C 'behavior':10A,49B,69B,94C 'case':63B 'caus':47B,92C 'code':73B 'confirm':72B 'contain':83C,97C 'count':5A,111C 'crash':66B 'current':57B,126C 'cve':11A,14A 'embedd':17B,117C 'enabl':46B,120C 'except':3A,37B,44B,102C,119C 'execut':74B 'exploit':54B,123C 'field':42B,115C 'flaw':29B,87C 'host':7A,41B,114C 'known':58B,127C 'later':40B 'layout':28B,90C 'memori':8A,27B,85C 'misalign':6A,39B,86C,112C 'modul':31B,96C,106C 'number':35B,100C 'odd':2A,34B,99C,109C 'path':55B,124C 'rather':70B 'realist':61B 'runtim':18B,24B 'say':52B 'sourc':51B 'subsequ':113C 'tag':4A,38B,103C,110C 'undefin':9A,48B,93C 'unpredict':68B 'vmcontext':89C 'wasmtim':1A,19B,21B,75C 'webassembl':20B,23B,105C 'worst':62B","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Wasmtime with WebAssembly exceptions enabled and load modules that define tags. Embedders that do not enable exceptions, or that run only trusted modules, have lower exposure. Teams on Wasmtime 47.x or 49.0.x before the fixed patches should review their version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119133","severity":null,"published_at":"2026-10-29T16:18:06+00:00","modified_at":"2026-10-29T16:18:06+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}