Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-115393 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:3.3 LOWVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:3.8 LOWVector:CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-787	Out-of-bounds Write	[email protected]

Affected Products

Product	Versions
bytecodealliance Wasmtime	<= 24.0.11 (semver) >= 25.0.0, < 36.0.13 (semver) >= 37.0.0, < 46.0.2 (semver) >= 47.0.0, < 47.0.3 (semver)
CPE cpe:2.3:a:bytecodealliance:wasmtime::::::rust::* Remediation Upgrade: 24.0.12moderate effort Upgrade: 36.0.13moderate effort Upgrade: 46.0.2moderate effort Upgrade: 47.0.3moderate effort Workaround:low effort Use a single `Engine` for the lifetime of the process. Workaround:low effort Ensure every object handed to a `Store` was created by that store's `Engine`. Example: ```rust use wasmtime::{Engine, Instance, Module, Result, Store, ensure}; fn instantiate<T>(store: &mut Store<T>, module: &Module) -> Result<Instance> { ensure!( Engine::same(store.engine(), module.engine()), "module comes from a different engine than the store", ); Instance::new(store, module, &[]) } ```

Product

Versions

bytecodealliance Wasmtime

<= 24.0.11 (semver)

>= 25.0.0, < 36.0.13 (semver)

>= 37.0.0, < 46.0.2 (semver)

>= 47.0.0, < 47.0.3 (semver)

CPE

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*

Remediation

Upgrade: 24.0.12moderate effort
Upgrade: 36.0.13moderate effort
Upgrade: 46.0.2moderate effort
Upgrade: 47.0.3moderate effort
Workaround:low effort
Use a single `Engine` for the lifetime of the process.
Workaround:low effort
Ensure every object handed to a `Store` was created by that store's `Engine`. Example: ```rust use wasmtime::{Engine, Instance, Module, Result, Store, ensure}; fn instantiate<T>(store: &mut Store<T>, module: &Module) -> Result<Instance> { ensure!( Engine::same(store.engine(), module.engine()), "module comes from a different engine than the store", ); Instance::new(store, module, &[]) } ```

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 29, 2026	CVE Modified	CISA-ADP
Oct 22, 2026	New CVE Received	[email protected]