Panic Vulnerability in Wasmtime Affected by Component Model Stream Type Mismatch

CVE-2026-119135

What is CVE-2026-119135?

A panic occurs in Wasmtime versions prior to 48.0.6 and 49.0.3 when a host reads a component model stream with an incorrect Rust item type. This issue arises because the host-to-host read path incorrectly asserts matching TypeIds instead of appropriately returning an error. The vulnerability allows guest code to return a StreamReader that the embedder interprets as StreamReader, which, despite both types mapping to the same component model type, leads to the embedding process crashing.

References