CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Q: Which deployments are exposed?

Deployments using Wasmtime versions 39.0.0 through versions before 48.0.4, or version 49.0.0 through versions before 49.0.2, are affected when they execute malicious components using mistyped component-model async callback functions.

Q: What does an attacker need to exploit this issue?

An attacker needs the ability to supply a malicious guest component with mistyped component-model-async callback functions. No user interaction is required, but the supplied CVSS vector indicates low privileges are required.

Q: What is the practical impact of successful exploitation?

A malicious guest can write approximately 16 KB to the native stack by exploiting unvalidated async callback result types. This can overwrite return addresses, crash the host, or escape the Wasmtime sandbox.

Q: What versions address the vulnerability?

Upgrade to Wasmtime 48.0.4 or later in the 48.x line, or 49.0.2 or later in the 49.x line.

Published Oct 22, 2026

Updated

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.

Affected Software

1 affected component

Bytecode Alliance Wasmtime>=39.0.0<48.0.4, >=49.0.0<49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Wasmtime versions 39.0.0 through versions before 48.0.4, or version 49.0.0 through versions before 49.0.2, are affected when they execute malicious components using mistyped component-model async callback functions.

What does an attacker need to exploit this issue?

An attacker needs the ability to supply a malicious guest component with mistyped component-model-async callback functions. No user interaction is required, but the supplied CVSS vector indicates low privileges are required.

What is the practical impact of successful exploitation?

A malicious guest can write approximately 16 KB to the native stack by exploiting unvalidated async callback result types. This can overwrite return addresses, crash the host, or escape the Wasmtime sandbox.

What versions address the vulnerability?

Upgrade to Wasmtime 48.0.4 or later in the 48.x line, or 49.0.2 or later in the 49.x line.

CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What versions address the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the practical impact of successful exploitation?

What versions address the vulnerability?