CVE-2026-119135 Details
Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.
A vulnerability in Wasmtime versions 46.0.0 prior to 48.0.6 and 49.0.0 prior to 49.0.3 can lead to a panic when the host reads a component model stream as a different Rust item type than it was originally created with. This issue arises because the host-to-host read path asserts matching TypeIds instead of returning an error. As a result, guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types correspond to the same component model type, causing the embedding process to crash.
Users can upgrade to Wasmtime versions 48.0.6 or 49.0.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 46.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |