CVE-2026-115383: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.
Other sources
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 48.0.4 - Upgrade
Upgrade
Wasmtimeto a version that resolves this vulnerability.Fixed in 49.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Wasmtime 47.0.0 before 48.0.4 or 49.0.0 before 49.0.2 are affected when the exceptions proposal is enabled and they execute malicious guest components.
What must an attacker be able to do to trigger the problem?
An attacker needs the ability to provide or cause execution of a crafted WebAssembly component containing core modules that import tags with a subtype of the original type. Exploitation also requires user interaction according to the supplied vector.
What is the practical impact of successful exploitation?
A malicious guest can mis-type exception object payloads and corrupt the GC heap. This causes Wasmtime to panic, resulting in a denial of service.
What mitigation is available if an upgrade cannot be applied immediately?
The issue is described as occurring when the exceptions proposal is enabled. Disabling that proposal prevents the stated exploitation condition until an update can be applied.