CVE-2026-126408: Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option<I31>, and Option<NoneRef> parameter or result types, reaching an unreachable!() path. A malicious guest module exporting a function that uses another anyref-hierarchy type can panic the host embedding, causing denial of service.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments embedding Wasmtime and using the TypedFunc embedder API with I31, Option<I31>, or Option<NoneRef> parameter or result types are exposed when they execute a malicious guest module that exports a function using another anyref-hierarchy type.
What does an attacker need to trigger the issue?
An attacker needs to provide or cause execution of a malicious guest module and have it reach the affected TypedFunc type-checking path. Exploitation causes the embedding host to panic, resulting in denial of service.
Which releases contain fixes?
The issue is fixed in Wasmtime 48.0.8, 49.0.5, and 50.0.1. Affected release ranges are 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1.