CVE-2026-119137
Deferred Deferred - Pending Action

Stack Overflow in Wasmtime Runtime

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119137
EUVD
EUVD-2026-113204

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bytecodealliance wasmtime 42.0.0
bytecodealliance wasmtime 49.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack overflow in Wasmtime versions 42.0.0 to 48.0.5 and 49.0.0 to 49.0.2. It allows guest code to crash the host by defining a long chain of recursive types. When the top-level type is removed, it triggers unbounded recursive drops that exhaust the host's stack memory.

Detection Guidance

To detect this vulnerability, check the installed version of Wasmtime on your system. Run: wasmtime --version. If the version is >= 42.0.0 and < 48.0.6 or >= 49.0.0 and < 49.0.3, the system is vulnerable.

Impact Analysis

This vulnerability can cause the host system to crash due to stack exhaustion. It requires no privileges or user interaction and only impacts availability. Affected systems may become unresponsive or reboot unexpectedly when exploited.

Mitigation Strategies

Immediately upgrade Wasmtime to a patched version: 48.0.6 or later, or 49.0.3 or later. No workarounds are available, so updating is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart