Type Check Bypass in Wasmtime WebAssembly Runtime
CVE-2026-115892
5.7MEDIUM
What is CVE-2026-115892?
The Wasmtime WebAssembly runtime has a vulnerability that affects versions from 46.0.0 to 48.0.7 and includes 49.0.4. This issue stems from a flaw where a component-model stream or future created by the host is passed into a guest without enforcing type-checking after executing guest code. If a malicious user controls the exported function types or the returned values, this could lead to type-erased values being improperly handled by the host, causing a panic state. The vulnerability has been resolved in versions 48.0.7 and 49.0.4, ensuring improved type safety in the Wasmtime environment.
Affected Version(s)
wasmtime >= 46.0.0, < 48.0.7 < 46.0.0, 48.0.7
wasmtime >= 49.0.0, < 49.0.4 < 49.0.0, 49.0.4