CVE-2026-115379: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across trycall unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
Other sources
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via trycall
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1
Event History
Frequently Asked Questions
Which deployments are affected?
Wasmtime 47.0.0 releases before 48.0.4 and Wasmtime 49.0.0 releases before 49.0.2 are affected.
What must an attacker be able to do to trigger the issue?
An attacker must be able to supply a WebAssembly module for compilation. The module's callee must trigger garbage collection while references remain live across try_call without being rooted.
What is the potential result of successful exploitation?
Successful exploitation can leave stale or dangling references and result in GC heap corruption or incorrect execution. The reported impact is availability-only, with no reported confidentiality or integrity impact.