CVE-2026-115384 Details

A stack buffer overflow vulnerability has been identified in Wasmtime versions 39.0.0 prior to 48.0.4, and 49.0.0 prior to 49.0.2. This vulnerability allows malicious guests to write approximately 16KB of arbitrary data to the native stack by exploiting unvalidated asynchronous callback result types. Attackers can manipulate components by supplying incorrectly typed asynchronous callback functions, leading to overwriting return addresses, crashing the host, or escaping the sandbox.

Users can upgrade to Wasmtime versions 48.0.4 or 49.0.2, both of which include a patch for this vulnerability. Alternatively, the 'component-model-async' feature can be disabled, which will cause Wasmtime to reject components that use asynchronous features, including async callbacks.