CVE-2026-126409: Wasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::withfinalityandsupertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Only Wasmtime embedders that use multiple Engine instances and create a GC struct type with a supertype obtained from a different Engine are exposed. Guest WebAssembly code cannot trigger the issue on its own.
What level of access is required to exploit it?
An attacker would need the ability to cause the embedding application to construct a GC struct type using a cross-engine supertype. The CVSS vector indicates high privileges, user interaction, and high attack complexity.
What can happen if the vulnerable API is misused?
The condition can cause runtime panics or GC heap corruption, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.
Which releases need to be updated?
Affected release lines are 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1. Update to the stated fixed release or later within the applicable release line.
What can be done before patching?
Ensure that every StructType::with_finality_and_supertype call receives a supertype created by the same Engine as the struct type. Avoid creating GC struct type inheritance relationships across Engine instances.