Live › vulnerability › CVE-2026-119143
Wasmtime is a WebAssembly runtime. Guest code can send zero-length component model stream reads or writes with unvalidated addresses, which makes the host panic and crash WASIp3 embedders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that embed Wasmtime 46.0.0 before 48.0.6 or 49.0.0 before 49.0.3 and run untrusted WebAssembly guests using WASIp3 component model streams are exposed to a host crash. Teams running only trusted guests, or versions outside these ranges, can skip it.
No product ranges from the sources yet.
wasmtime in Cargo.lock48.0.6 on the 48 line49.0.3 on the 49 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.
This page as .md · .json · in your agent: get_signal("CVE-2026-119143")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.