CVE-2026-115383 | BDVDB-2026-394658 Detail

Description#

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-22Record published in the CVE List.
2. Version 22026-11-04Most recent update recorded in the CVE List.