CVE-2026-115892

Deferred Deferred - Pending Action

Type Confusion in Wasmtime WebAssembly Runtime

Publication date: 2026-10-23

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-23

Last Modified

2026-10-23

Generated

2026-10-25

AI Q&A

2026-10-24

EPSS Evaluated

N/A

NVD

CVE-2026-115892

Affected Vendors & Products

Vendor	Product	Version / Range
bytecodealliance	wasmtime	>= 46.0.0, < 48.0.7
bytecodealliance	wasmtime	>= 49.0.0, < 49.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects Wasmtime, a WebAssembly runtime. It occurs when lowering a host-created component-model stream or future into a guest, a required payload-type check is omitted after the value passes through guest code. A malicious guest controlling exported function types or returned values can cause the host to pass a type-erased value to a guest expecting a different payload type, leading to a host panic.

Detection Guidance

This vulnerability affects Wasmtime versions between 46.0.0 and 48.0.7, and 49.0.0 to 49.0.3. To detect it, check your Wasmtime version using 'wasmtime --version'. If the version is within the affected range, update to 48.0.7 or 49.0.4 or later immediately.

Impact Analysis

This vulnerability can cause the Wasmtime host to crash (panic) due to type confusion. If exploited, it may lead to denial of service for applications relying on Wasmtime. The impact is limited to host systems running affected versions of Wasmtime.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a runtime environment for WebAssembly. The issue involves type mismatches in host-guest interactions, which could lead to crashes but does not inherently involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Update Wasmtime to version 48.0.7 or 49.0.4 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-115892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70