CVE-2026-119139: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.
Event History
Frequently Asked Questions
Which deployments are exposed to this crash?
Deployments using Wasmtime versions 46.0.0 through before 48.0.6, or 49.0.0 through before 49.0.3, may be exposed if the host invokes a component export through component::Func::call.
What must an attacker be able to do to trigger the issue?
The attacker must be able to supply a component containing an async-lifted export and cause the embedder to invoke that export using Func::call. Successful exploitation crashes the host process.
Are applications affected merely by loading an untrusted component?
The described trigger requires more than loading the component: the embedder must invoke the component's async-lifted export through Func::call. The available information does not establish that all default configurations are affected.
What versions address the issue?
The affected version ranges end at 48.0.6 and 49.0.3. Update to 48.0.6 or later in the 48.x line, or 49.0.3 or later in the 49.x line.