CVE-2026-115389Low· 2.3▾ SunlitWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebA…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
0.2% → 0.2%
Last analysed / modified upstream
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values through the dynamically-typed Val API, bypassing the hostcall fuel limit. A malicious WebAssembly guest can return crafted values that allocate at least ~100x more host memory than tracked, causing denial of service.
wasmtime < 36.0.16wasmtime >= 37.0.0 < 48.0.3wasmtime >= 49.0.0 < 49.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wasmtime >= 49.0.0, < 49.0.1Patched in:
wasmtime 49.0.1Connected by shared product, vendor, weakness, or advisory.
RUSTSEC-2026-0316NoneDynamic record lifting can allocate beyond the hostcall fuel limit
CVE-2026-115391Medium· 5.8Guest controlled-size host heap allocation through WASIp3 streams
CVE-2026-44216High· 7.5Wasmtime is a runtime for WebAssembly
CVE-2026-115892Medium· 5.7Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115889Critical· 9.9Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-115893Critical· 9.9Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction