Live › vulnerability › CVE-2026-119140
Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 let a malicious WebAssembly component panic the host process through thread.yield in a start function. The attacker only gets a denial of service that crashes applications embedding Wasmtime.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime 46.0.0 to 48.0.5 or 49.0.0 to 49.0.2 and run WebAssembly components supplied by untrusted parties are exposed. A component whose start function calls an async-lowered import and then thread.yield can crash the host. Teams running only trusted components or on the fixed versions can skip it.
No product ranges from the sources yet.
wasmtime --version or the wasmtime entry in Cargo.lock.48.0.649.0.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.
This page as .md · .json · in your agent: get_signal("CVE-2026-119140")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.