Type Confusion Vulnerability in Wasmtime Engine by Bytecode Alliance
CVE-2026-115393

1LOW

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115393?

Wasmtime, a popular WebAssembly runtime, has a vulnerability related to type confusion that occurs when multiple Store APIs fail to correctly validate that objects belong to the Store's Engine. This can lead to serious security risks, including out-of-bounds stack writes and garbage collection heap corruption, particularly when embedders incorrectly mix objects between different Engines. The misuse of Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches, resulting in application instability and potential data exposure.

Affected Version(s)

wasmtime 0 < 24.0.12

wasmtime 25.0.0 < 36.0.13

wasmtime 37.0.0 < 46.0.2

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-24.0...
third-party-advisory

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.