Denial of Service Vulnerability in Wasmtime by Bytecode Alliance

CVE-2026-119138

What is CVE-2026-119138?

The Wasmtime runtime versions prior to 48.0.6 and from 49.0.0 to 49.0.2 are susceptible to a denial of service vulnerability. This flaw occurs when pending function calls trigger assertion failures after a trap results in an inconsistent Store state. Malicious attackers can exploit this by supplying faulty guest code, leading to a trap that can cause earlier calls to execute, ultimately crashing any embedders that continue to rely on the compromised Store. This vulnerability underscores the importance of maintaining updated software to mitigate potential exploitation.

References