CVE-2026-119133
Deferred Deferred - Pending Action

Memory Misalignment in Wasmtime WebAssembly Runtime

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119133
EUVD
EUVD-2026-113200

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bytecodealliance wasmtime 47.0.0
bytecodealliance wasmtime 49.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-758 The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory misalignment flaw in Wasmtime versions 47.0.0 through 48.0.5 and 49.0.0 through 49.0.2. It occurs when a WebAssembly module contains an odd number of exception tags, causing misalignment in the VMContext data structure. This leads to undefined behavior in Rust, which could cause issues with future compiler updates.

Detection Guidance

To detect this vulnerability, check the installed Wasmtime version using the command: wasmtime --version. If the version is between 47.0.0-48.0.5 or 49.0.0-49.0.2, the system is vulnerable.

Impact Analysis

The impact is currently limited as no exploitation path is known. However, undefined behavior could potentially lead to security issues or crashes in affected systems. Users with WebAssembly exceptions enabled (default in Wasmtime 47.0.0+) are at risk. The vulnerability has low severity with minimal impact on confidentiality, integrity, or availability.

Mitigation Strategies

Update Wasmtime to version 48.0.6 or 49.0.3 or later. Alternatively, disable exception support in Wasmtime if updating is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart