Memory Misalignment in Wasmtime Affects Multiple Versions
CVE-2026-119133

2.1LOW

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119133?

A memory misalignment flaw has been identified in Wasmtime versions prior to 48.0.6 and 49.0.3. This issue arises in the VMContext layout and leads to undefined behavior when modules incorporate an odd number of exception tags. The misalignment can disrupt the placement of subsequent host fields when exceptions are enabled within the embedders. While currently there is no known exploitation path for this vulnerability, it is critical for users to update to the latest versions to mitigate any potential risks.

Affected Version(s)

wasmtime 47.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

wasmtime 48.0.6

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-47.0.0-befo...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.