CVE-2026-115383 Details

A vulnerability in Wasmtime versions 47.0.0 prior to 48.0.4 and 49.0.0 prior to 49.0.2 allows for improper validation of WebAssembly components. The issue arises because the validation process accepts components whose core modules import WebAssembly tags with subtypes that deviate from the original type, contrary to the WebAssembly specification. This flaw enables malicious guests to mis-type exception object payloads, leading to corruption of the garbage collection (GC) heap. Although Wasmtime's GC heap is designed to withstand corruption, this vulnerability can cause Wasmtime to panic, particularly when the WebAssembly exceptions proposal is enabled, which is the default starting in Wasmtime 47.0.0.

Users are advised to upgrade to Wasmtime versions 48.0.4 or 49.0.2, which address this vulnerability by implementing proper validation and rejecting malformed components. If an immediate upgrade is not possible, users can disable the WebAssembly exceptions proposal to mitigate the issue.