Denial-of-Service Vulnerability in Wasmtime from Bytecode Alliance

CVE-2026-119132

What is CVE-2026-119132?

Wasmtime versions prior to 49.0.3 exhibit a vulnerability that allows attackers to execute denial-of-service attacks by crafting overlapping string transcoding in fused adapters. Specifically, a malicious WebAssembly guest can trigger a host panic by initiating a component-to-component call with strings whose source and destination reference the same memory space, resulting in a crash instead of generating the expected trap. This vulnerability underscores the importance of proper input validation and memory handling within WebAssembly environments.

References