---
id: CVE-2026-115892
title: >-
  Wasmtime: Panic lowering a host-created component model stream into a guest
  that expects a different payload type
summary: >-
  Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4,
  lowering a host-created component-model stream or future into a guest can omit
  a required payload-type check after the value passes through guest code and
  return…
severity: medium
cvss: 5.7
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-843
  - CWE-248
vendor: bytecodealliance
product: wasmtime
affected:
  - 'wasmtime >= 46.0.0, < 48.0.7'
  - 'wasmtime >= 49.0.0, < 49.0.4'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T14:44:25.732629Z'
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T14:44:33.323Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115892'
references:
  - url: >-
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5
    label: >-
      https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5
  - url: 'https://github.com/bytecodealliance/wasmtime/pull/14819'
    label: 'https://github.com/bytecodealliance/wasmtime/pull/14819'
  - url: 'https://github.com/bytecodealliance/wasmtime/pull/14820'
    label: 'https://github.com/bytecodealliance/wasmtime/pull/14820'
  - url: 'https://github.com/bytecodealliance/wasmtime/pull/14827'
    label: 'https://github.com/bytecodealliance/wasmtime/pull/14827'
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
    label: >-
      https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
    label: >-
      https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
  - url: >-
      https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
    label: >-
      https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
  - url: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7'
    label: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7'
  - url: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4'
    label: 'https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4'
  - url: 'https://crates.io/crates/wasmtime'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0378.html'
  - url: 'https://github.com/bytecodealliance/wasmtime'
  - url: 'https://github.com/advisories/GHSA-9pvw-hwfg-92h5'
tags:
  - cve.org
  - osv
  - rust
  - ghsa
epss: 0.00434
epssPercentile: 0.3779
aliases:
  - RUSTSEC-2026-0378
  - GHSA-9pvw-hwfg-92h5
ecosystem: rust
patched:
  - wasmtime 49.0.4
ingestedAt: '2026-10-23T21:38:13.048Z'
---

## Overview

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.

## Affected

- `wasmtime >= 46.0.0, < 48.0.7`
- `wasmtime >= 49.0.0, < 49.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115892)

Affected packages:

- `wasmtime >= 49.0.0, < 49.0.4`

Patched in:

- `wasmtime 49.0.4`

Source: https://osv.dev/vulnerability/RUSTSEC-2026-0378