Live › vulnerability › CVE-2026-119136
Wasmtime, a WebAssembly runtime, does not fully check calls that mix async-style and sync-style WebAssembly entry points when a host function re-enters WebAssembly. An attacker who can drive such an embedder can trigger runtime panics or move non-thread-safe host variables across threads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only embedders of Wasmtime 42.x or 49.0.x-before-49.0.3 that re-enter WebAssembly through sync APIs from asynchronously called host functions are exposed. Applications that only run trusted modules or use a single calling style are less likely to be reached; the sources do not say how common this pattern is.
No product ranges from the sources yet.
wasmtime --version or check the wasmtime crate version in Cargo.lock42.0.0 before 48.0.6 and before are affected; move to or or later on the matching release line49.0.049.0.348.0.649.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.
This page as .md · .json · in your agent: get_signal("CVE-2026-119136")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.