CVE-2026-115383: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports

Q: Which deployments are exposed to this issue?

Deployments using Wasmtime 47.0.0 before 48.0.4 or 49.0.0 before 49.0.2 are affected when the exceptions proposal is enabled and they execute malicious guest components.

Q: What must an attacker be able to do to trigger the problem?

An attacker needs the ability to provide or cause execution of a crafted WebAssembly component containing core modules that import tags with a subtype of the original type. Exploitation also requires user interaction according to the supplied vector.

Q: What is the practical impact of successful exploitation?

A malicious guest can mis-type exception object payloads and corrupt the GC heap. This causes Wasmtime to panic, resulting in a denial of service.

Q: What mitigation is available if an upgrade cannot be applied immediately?

The issue is described as occurring when the exceptions proposal is enabled. Disabling that proposal prevents the stated exploitation condition until an update can be applied.

Published Oct 22, 2026

Updated

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.

Affected Software

1 affected component

Bytecode Alliance Wasmtime>=47.0.0<48.0.4, >=49.0.0<49.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 48.0.4
Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Wasmtime 47.0.0 before 48.0.4 or 49.0.0 before 49.0.2 are affected when the exceptions proposal is enabled and they execute malicious guest components.

What must an attacker be able to do to trigger the problem?

An attacker needs the ability to provide or cause execution of a crafted WebAssembly component containing core modules that import tags with a subtype of the original type. Exploitation also requires user interaction according to the supplied vector.

What is the practical impact of successful exploitation?

A malicious guest can mis-type exception object payloads and corrupt the GC heap. This causes Wasmtime to panic, resulting in a denial of service.

What mitigation is available if an upgrade cannot be applied immediately?

The issue is described as occurring when the exceptions proposal is enabled. Disabling that proposal prevents the stated exploitation condition until an update can be applied.

CVE-2026-115383: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to trigger the problem?

What is the practical impact of successful exploitation?

What mitigation is available if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do to trigger the problem?

What is the practical impact of successful exploitation?

What mitigation is available if an upgrade cannot be applied immediately?