CVE-2026-119136 Details
Description
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.
A vulnerability exists in Wasmtime versions 42.0.0 prior to 48.0.6 and 49.0.0 prior to 49.0.3, due to inadequate checks in the 'Store' component when handling asynchronous and synchronous WebAssembly calls. This issue allows embedders to re-enter WebAssembly through synchronous APIs from host functions that were called asynchronously, potentially causing runtime panics or unsafe cross-thread transfer of host variables that are not thread-safe.
Users can upgrade to Wasmtime versions 48.0.6 or 49.0.3, both of which address this vulnerability. If a store requires asynchronous entry points, this will automatically enforce the correct usage.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 42.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |