CVE-2026-115383

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,8
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.

1287

Improper Validation of Specified Type of Input

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/bytecodealliance/wasmtime/security/advis…
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr…
https://www.vulncheck.com/advisories/wasmtime-47.0.0-before…
https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-b…