CVE-2026-119141 Details
Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.
A denial-of-service vulnerability has been identified in Wasmtime versions 46.0.0 prior to 48.0.6, and 49.0.0 prior to 49.0.3. This vulnerability allows malicious WebAssembly (Wasm) modules to cause the host to panic. The issue arises because the 'may_leave' flag is not properly cleared during the reallocation process. As a result, attackers can invoke host panics by manipulating streams or future results, such as canceling active reads or interfering with waitable sets, leading to a crash of the host.
Users can upgrade to Wasmtime versions 48.0.6 or 49.0.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance Wasmtime | >= 46.0.0, < 48.0.6 (semver) >= 49.0.0, < 49.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |