CVE-2026-115379: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call

Q: Which deployments are affected?

Wasmtime 47.0.0 releases before 48.0.4 and Wasmtime 49.0.0 releases before 49.0.2 are affected.

Q: What must an attacker be able to do to trigger the issue?

An attacker must be able to supply a WebAssembly module for compilation. The module's callee must trigger garbage collection while references remain live across try_call without being rooted.

Q: What is the potential result of successful exploitation?

Successful exploitation can leave stale or dangling references and result in GC heap corruption or incorrect execution. The reported impact is availability-only, with no reported confidentiality or integrity impact.

Published Oct 22, 2026

Updated

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across trycall unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

Affected Software

1 affected component

Bytecode Alliance Wasmtime>=47.0.0<48.0.4, >=49.0.0<49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Wasmtime 47.0.0 releases before 48.0.4 and Wasmtime 49.0.0 releases before 49.0.2 are affected.

What must an attacker be able to do to trigger the issue?

An attacker must be able to supply a WebAssembly module for compilation. The module's callee must trigger garbage collection while references remain live across try_call without being rooted.

What is the potential result of successful exploitation?

Successful exploitation can leave stale or dangling references and result in GC heap corruption or incorrect execution. The reported impact is availability-only, with no reported confidentiality or integrity impact.

CVE-2026-115379: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to trigger the issue?

What is the potential result of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker be able to do to trigger the issue?

What is the potential result of successful exploitation?