{"id":"CVE-2026-126409","kind":"vulnerability","aliases":["CVE-2026-126409"],"related":[],"title":"Wasmtime: cross-engine supertype check missing lets embedders corrupt GC heap","description":"Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.","summary":"Wasmtime's StructType::with_finality_and_supertype does not check that a supertype belongs to the same Engine, so mixing engines can cause runtime panics or GC heap corruption. The result is denial of service; guest WebAssembly code cannot trigger it.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wasmtime","fixed":[],"affected":"","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["runtime","rust","wasmtime","webassembly"],"not_affected_if":["guest-only-wasm","single-engine","wasmtime-outside-affected-ranges"],"how_to_check":"- Check the Wasmtime version in your build: `wasmtime --version` or the wasmtime crate version in `Cargo.lock`.\n- Look for code that creates more than one Engine and builds GC struct types with supertypes (StructType::with_finality_and_supertype).","fix":"- Wasmtime `48.0.8`\n- Wasmtime `49.0.5`\n- Wasmtime `50.0.1`","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:59:04+00:00","updated_at":"2026-11-13T10:59:04+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:59:04Z","model":"claude-haiku-5-5","output":{"fix":"- Wasmtime `48.0.8`\n- Wasmtime `49.0.5`\n- Wasmtime `50.0.1`","reach":"local","title":"Wasmtime: cross-engine supertype check missing lets embedders corrupt GC heap","impact":"low","summary":"Wasmtime's StructType::with_finality_and_supertype does not check that a supertype belongs to the same Engine, so mixing engines can cause runtime panics or GC heap corruption. The result is denial of service; guest WebAssembly code cannot trigger it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wasmtime","rust","webassembly"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"runtime panic or GC heap corruption causing denial of service","analyst_note":"","how_to_check":"- Check the Wasmtime version in your build: `wasmtime --version` or the wasmtime crate version in `Cargo.lock`.\n- Look for code that creates more than one Engine and builds GC struct types with supertypes (StructType::with_finality_and_supertype).","plain_action":"","product_name":"wasmtime","needs_analyst":false,"not_affected_if":["single-engine","guest-only-wasm","wasmtime-outside-affected-ranges"],"who_is_affected":"Only embedders that run several Wasmtime Engine instances in one process and create GC struct types using a supertype from another engine can hit this. Guest WebAssembly modules cannot trigger it, so single-engine hosts and plain Wasm runners are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"cargo","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000775,"input_tokens":4692,"output_tokens":612,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126409':15A,18A '-2026':14A,17A '47.0.0':65C '48.0.8':67C '49.0.0':68C '49.0.5':70C '50.0.0':72C '50.0.1':74C 'anoth':112C 'belong':37B,96C 'cannot':62B,130C 'caus':46B,124C 'check':6A,33B 'code':61B 'confus':81C 'contain':75C 'corrupt':10A,52B,123C 'creat':106C 'cross':3A,78C 'cross-engin':2A,77C 'cve':13A,16A 'denial':56B,125C 'embedd':9A,101C 'engin':4A,41B,44B,79C,100C,104C,113C 'final':28B,86C 'gc':11A,50B,108C,121C 'guest':59B,128C 'heap':12A,51B,122C 'let':8A 'miss':7A 'mix':43B 'multipl':103C 'panic':48B,119C 'result':54B 'runtim':20B,47B,118C 'rust':21B 'servic':58B,127C 'struct':109C 'structtyp':26B,84C 'supertyp':5A,30B,36B,88C,95C,115C 'suppli':94C 'trigger':63B,117C,131C 'type':80C,110C 'use':102C 'valid':91C 'vulner':82C 'wasmtim':1A,22B,24B,64C 'wasmtime':19A 'webassembl':23B,60B,129C","nicknames":[],"mitigations":[],"who_affected":"Only embedders that run several Wasmtime Engine instances in one process and create GC struct types using a supertype from another engine can hit this. Guest WebAssembly modules cannot trigger it, so single-engine hosts and plain Wasm runners are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wasmtime"],"ptokens":["wasmtime"],"labels":["cargo","low","runtime","rust","wasmtime","webassembly"],"campaign_type":null,"search_a":"'-126409':15A,18A '-2026':14A,17A 'check':6A 'corrupt':10A 'cross':3A 'cross-engin':2A 'cve':13A,16A 'embedd':9A 'engin':4A 'gc':11A 'heap':12A 'let':8A 'miss':7A 'supertyp':5A 'wasmtim':1A 'wasmtime':19A","search_b":"'belong':37B 'cannot':62B 'caus':46B 'check':33B 'code':61B 'corrupt':52B 'denial':56B 'engin':41B,44B 'final':28B 'gc':50B 'guest':59B 'heap':51B 'mix':43B 'panic':48B 'result':54B 'runtim':20B,47B 'rust':21B 'servic':58B 'structtyp':26B 'supertyp':30B,36B 'trigger':63B 'wasmtim':22B,24B 'webassembl':23B,60B","search_c":"'47.0.0':65C '48.0.8':67C '49.0.0':68C '49.0.5':70C '50.0.0':72C '50.0.1':74C 'anoth':112C 'belong':96C 'cannot':130C 'caus':124C 'confus':81C 'contain':75C 'corrupt':123C 'creat':106C 'cross':78C 'cross-engin':77C 'denial':125C 'embedd':101C 'engin':79C,100C,104C,113C 'final':86C 'gc':108C,121C 'guest':128C 'heap':122C 'multipl':103C 'panic':119C 'runtim':118C 'servic':127C 'struct':109C 'structtyp':84C 'supertyp':88C,95C,115C 'suppli':94C 'trigger':117C,131C 'type':80C,110C 'use':102C 'valid':91C 'vulner':82C 'wasmtim':64C 'webassembl':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T19:06:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126409","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145061,"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qw58-7h65-crq2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T19:06:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145062,"url":"https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.8-cross-engine-type-confusion-via-structtype-supertype","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}