{"id":"CVE-2026-115892","title":"Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type","summary":"Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and return…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-843","CWE-248"],"vendor":"bytecodealliance","product":"wasmtime","affected":["wasmtime >= 46.0.0, < 48.0.7","wasmtime >= 49.0.0, < 49.0.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T14:44:25.732629Z"},"published":"2026-10-23","updated":"2026-10-29","sourceUpdated":"2026-10-29T14:44:33.323Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115892","references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5","label":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14819","label":"https://github.com/bytecodealliance/wasmtime/pull/14819"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14820","label":"https://github.com/bytecodealliance/wasmtime/pull/14820"},{"url":"https://github.com/bytecodealliance/wasmtime/pull/14827","label":"https://github.com/bytecodealliance/wasmtime/pull/14827"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd","label":"https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158","label":"https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158"},{"url":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618","label":"https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7"},{"url":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4","label":"https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4"},{"url":"https://crates.io/crates/wasmtime"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0378.html"},{"url":"https://github.com/bytecodealliance/wasmtime"},{"url":"https://github.com/advisories/GHSA-9pvw-hwfg-92h5"}],"tags":["cve.org","osv","rust","ghsa"],"epss":0.00434,"epssPercentile":0.37663,"aliases":["RUSTSEC-2026-0378","GHSA-9pvw-hwfg-92h5"],"ecosystem":"rust","patched":["wasmtime 49.0.4"],"ingestedAt":"2026-10-23T21:38:13.048Z","slug":"CVE-2026-115892","body":"## Overview\n\nWasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.\n\n## Affected\n\n- `wasmtime >= 46.0.0, < 48.0.7`\n- `wasmtime >= 49.0.0, < 49.0.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-115892)\n\nAffected packages:\n\n- `wasmtime >= 49.0.0, < 49.0.4`\n\nPatched in:\n\n- `wasmtime 49.0.4`\n\nSource: https://osv.dev/vulnerability/RUSTSEC-2026-0378","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}