---
id: "CVE-2026-119133"
kind: "vulnerability"
aliases: ["CVE-2026-119133"]
title: "Wasmtime: odd exception tag count misaligns host memory, undefined behavior"
severity: "low"
cvss: 2.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedders", "runtime", "wasmtime", "webassembly"]
not_affected_if: ["exceptions-disabled", "trusted-modules-only", "wasmtime-not-used"]
published_at: "2026-10-29T16:18:06+00:00"
first_seen_at: "2026-10-29T16:25:58+00:00"
updated_at: "2026-10-29T16:32:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119133", "first_seen_at": "2026-10-29T16:25:58+00:00"}]
---

# Wasmtime: odd exception tag count misaligns host memory, undefined behavior

Wasmtime, a WebAssembly runtime, has a memory layout flaw: a module with an odd number of exception tags misaligns later host fields when exceptions are enabled, causing undefined behavior. The sources say no exploitation path is currently known, so the realistic worst case is a crash or unpredictable behavior rather than confirmed code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Wasmtime version in your build or lockfile; affected versions are 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3.
- Check whether your embedder enables WebAssembly exception handling (the exceptions feature) when loading modules.

## Fix

- Move to `48.0.6` on the 48.x line, or `49.0.3` on the 49.x line.

## Timeline

- 2026-10-29T16:25:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119133

## From the sources

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_