CVE-2026-115379 Details
Description
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
A vulnerability exists in Wasmtime versions 47.0.0 prior to 48.0.4 and 49.0.0 prior to 49.0.2, where garbage collection (GC) references are not properly rooted across 'try_call' invocations when compiling WebAssembly (Wasm) modules. This flaw allows attackers to introduce Wasm modules that, when executed, trigger garbage collection and leave behind stale or dangling references. Such references can lead to corruption of the GC heap or cause incorrect execution of the Wasm module.
Users can update to Wasmtime versions 48.0.4 or 49.0.2, where this vulnerability has been patched. Alternatively, exception support can be disabled in the command-line interface or through the Wasmtime API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 47.0.0, < 48.0.4 (semver) >= 49.0.0, < 49.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |