WebAssembly Async-Entry Point Enforcement Issues in Wasmtime by Bytecode Alliance
CVE-2026-119136

5.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119136?

The Wasmtime WebAssembly runtime prior to version 48.0.6 and 49.0.3 exhibits vulnerabilities due to insufficient checks in its Store component when handling asynchronous and synchronous WebAssembly calls. This issue arises when emulators re-enter WebAssembly using synchronous APIs triggered from asynchronously invoked host functions, leading to potential runtime panics or the unsafe transfer of !Send host variables across threads.

Affected Version(s)

wasmtime 42.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

wasmtime 48.0.6

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-42.0.0-befo...
third-party-advisory

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.