Stack Overflow Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-119137

6.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119137?

A stack overflow vulnerability exists in Wasmtime versions before 48.0.6 and 49.0.0 before 49.0.3. This flaw allows an attacker to exploit recursive type drops, potentially causing a crash of the host environment. When guests define excessive recursive types, the deletion of the uppermost type results in uncontrollable recursive drops, which can overwhelm the host's stack memory. This situation poses a significant risk of service disruption, highlighting the necessity for users to upgrade to patched versions to avoid exploitation.

Affected Version(s)

wasmtime 42.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

wasmtime 48.0.6

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-42.0.0-befo...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.