Stack Buffer Overflow Vulnerability in Wasmtime by Bytecode Alliance

CVE-2026-115384

What is CVE-2026-115384?

The Wasmtime runtime, versions 39.0.0 prior to 48.0.4 and 49.0.0 before 49.0.2, contains a vulnerability that enables untrusted components to overwrite memory on the native stack due to unvalidated async callback results. Malicious actors can exploit this flaw by leveraging improperly defined component-model-async callback functions, potentially crashing the host environment or breaching the sandboxing that is designed to contain unsafe operations.

References