All vulnerabilities
CVE-2026-115393GHSA-hgjw-h833-99q9

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion

bytecodealliance wasmtime
Open in ThreatlineRecord JSON
CVSS
1.0Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.09%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in24.0.12Also 36.0.13, 46.0.2 and 1 moreCVE List
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.

Text from CVE List

Affected versions 12

  • wasmtimeaffected: all versions before 24.0.12CVE List
  • wasmtimeunaffected: 24.0.12CVE List
  • wasmtimeaffected: 25.0.0 before 36.0.13CVE List
  • wasmtimeunaffected: 36.0.13CVE List
  • wasmtimeaffected: 37.0.0 before 46.0.2CVE List
  • wasmtimeunaffected: 46.0.2CVE List
  • wasmtimeaffected: 47.0.0 before 47.0.3CVE List
  • wasmtimeunaffected: 47.0.3CVE List
  • wasmtime, rust<= 24.0.11GitHub
  • wasmtime, rust>= 25.0.0, <= 36.0.12GitHub
  • wasmtime, rust>= 37.0.0, <= 46.0.1GitHub
  • wasmtime, rust47.0.0, 47.0.1, 47.0.2GitHub

References 2