CVE-2026-119141
Deferred Deferred - Pending Action

Denial of Service in Wasmtime via Realloc Panic

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-119141
EUVD
EUVD-2026-113208

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bytecodealliance wasmtime 46.0.0
bytecodealliance wasmtime 49.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1265 The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally produces a nested invocation of the non-reentrant code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Wasmtime versions 46.0.0 through 48.0.5 and 49.0.0 through 49.0.2. It is a denial of service issue where malicious WebAssembly modules can trigger a host panic by exploiting improper handling of the may_leave flag during realloc operations. The flaw allows attackers to call into the host from realloc while lowering stream or future results, causing crashes.

Detection Guidance

Detecting this vulnerability requires checking the installed Wasmtime version. Run 'wasmtime --version' to see if your version is between 46.0.0-48.0.5 or 49.0.0-49.0.2. If using the component-model-async feature, verify if the version is affected.

Impact Analysis

This vulnerability can crash the host system running Wasmtime, leading to denial of service. Attackers can exploit it to cause unexpected terminations by triggering panics during realloc operations, especially if the component-model-async feature is enabled.

Mitigation Strategies

Upgrade Wasmtime to version 48.0.6 or later for the 46.x branch, or to 49.0.3 or later for the 49.x branch. If upgrading is not possible, disable the component-model-async feature if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart