CVE-2026-126408
Deferred Deferred - Pending Action

Type Confusion in Wasmtime Leading to Denial of Service

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option<I31>, and Option<NoneRef> parameter or result types, reaching an unreachable!() path. A malicious guest module exporting a function that uses another anyref-hierarchy type can panic the host embedding, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126408
EUVD
EUVD-2026-125035

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
wasmtime wasmtime to 48.0.8 (exc)
wasmtime wasmtime to 49.0.5 (exc)
wasmtime wasmtime to 50.0.1 (exc)
bytecodealliance wasmtime From 47.0.0 (inc) to 48.0.7 (inc)
bytecodealliance wasmtime From 49.0.0 (inc) to 49.0.4 (inc)
bytecodealliance wasmtime 50.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in Wasmtime versions 47.0.0 to 48.0.7, 49.0.0 to 49.0.4, and 50.0.0. It occurs due to insufficient type-checking in the TypedFunc embedder API for specific parameter or result types like I31, Option<I31>, and Option<NoneRef>. A malicious guest module can trigger a panic in the host by exporting a function with an anyref-hierarchy type, causing the host to crash.

Detection Guidance

Check Wasmtime version with `wasmtime --version`. If running versions 47.0.0-48.0.7, 49.0.0-49.0.4, or 50.0.0, the system is vulnerable. Monitor for panics or crashes in host applications using Wasmtime.

Impact Analysis

This vulnerability can impact you by allowing an attacker to crash your Wasmtime-based application through a denial-of-service attack. If your system uses affected Wasmtime versions and processes untrusted WebAssembly modules, a malicious module could trigger a panic, halting the host process and disrupting service.

Mitigation Strategies

Upgrade Wasmtime to patched versions 48.0.8, 49.0.5, or 50.0.1. If upgrading is not possible, avoid using TypedFunc API with I31, Option<I31>, or Option<NoneRef> types in guest modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...