Improper Validation in Wasmtime Affects WebAssembly Components

CVE-2026-115383

What is CVE-2026-115383?

Earlier versions of Wasmtime, specifically 47.0.0 and 48.0.0 before 48.0.4, as well as 49.0.0 before 49.0.2, exhibit an improper validation flaw. This flaw allows malicious components to potentially import WebAssembly tags that do not match the original types. By mis-typing exception object payloads, attackers can exploit this vulnerability to corrupt the garbage collection (GC) heap. This can lead to unexpected behavior, including panic conditions when the exceptions proposal is enabled, posing significant risks to application stability and security.

References