CVE-2026-115384Critical· 9.9▾ MidnightWasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply compo…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
wasmtime >= 39.0.0 < 48.0.4wasmtime >= 49.0.0 < 49.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wasmtime >= 49.0.0, < 49.0.2Patched in:
wasmtime 49.0.2Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0327NoneWasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CVE-2026-115383Medium· 4.8Mis-typed WebAssembly tag imports can lead to GC heap corruption
RUSTSEC-2026-0325NoneMis-typed WebAssembly tag imports can lead to GC heap corruption
CVE-2026-115892Medium· 5.7Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115889Critical· 9.9Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-115893Critical· 9.9Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction