CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Other sources
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Wasmtime versions 39.0.0 through versions before 48.0.4, or version 49.0.0 through versions before 49.0.2, are affected when they execute malicious components using mistyped component-model async callback functions.
What does an attacker need to exploit this issue?
An attacker needs the ability to supply a malicious guest component with mistyped component-model-async callback functions. No user interaction is required, but the supplied CVSS vector indicates low privileges are required.
What is the practical impact of successful exploitation?
A malicious guest can write approximately 16 KB to the native stack by exploiting unvalidated async callback result types. This can overwrite return addresses, crash the host, or escape the Wasmtime sandbox.
What versions address the vulnerability?
Upgrade to Wasmtime 48.0.4 or later in the 48.x line, or 49.0.2 or later in the 49.x line.