Live › vulnerability › CVE-2026-119141
Wasmtime, a WebAssembly runtime, panics the host when a malicious Wasm module calls back into the host during a realloc while lowering stream or future results. An attacker who supplies a crafted module can crash the process that runs it, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime and run untrusted or third-party WebAssembly modules are exposed, because a malicious module can trigger the panic from inside the host. Services that only run trusted, self-authored Wasm modules face much lower risk. Teams on Wasmtime versions outside the affected ranges can skip it.
No product ranges from the sources yet.
wasmtime --version or the wasmtime crate version in Cargo.lock46.0.0 to before 48.0.6, and 49.0.0 to before 49.0.348.0.6 on the 48 line49.0.3 on the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.
This page as .md · .json · in your agent: get_signal("CVE-2026-119141")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.