Live › vulnerability › CVE-2026-119139
Wasmtime, a WebAssembly runtime, contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder calls that export through Func::call.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime and load WebAssembly components from sources they do not fully control, then invoke an export through Func::call. Hosts that only run their own trusted components, or that do not use the component model's Func::call path, are less exposed. The sources do not say whether any default configuration triggers the assertion.
No product ranges from the sources yet.
wasmtime 46.0.0 before 48.0.6 or 49.0.0 before 49.0.3 is affected.Func::call on component exports while loading untrusted or third-party WebAssembly components.48.0.6 or later for the 46/48 line49.0.3 or later for the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.
This page as .md · .json · in your agent: get_signal("CVE-2026-119139")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.