Denial of Service in Wasmtime by Bytecode Alliance
CVE-2026-119141

6.9MEDIUM

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119141?

The vulnerability in Wasmtime versions earlier than 48.0.6 and 49.0.3 can lead to a denial of service. It occurs due to an oversight regarding the may_leave flag, which remains unreset during the realloc process. Malicious WebAssembly (Wasm) modules can exploit this flaw to invoke panic in the host system, potentially causing it to crash. This behavior can be triggered when these modules interact with the realloc function, disrupting ongoing operations and leading to a complete host shutdown.

Affected Version(s)

wasmtime 46.0.0 < 48.0.6

wasmtime 49.0.0 < 49.0.3

wasmtime 48.0.6

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-befo...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tschneidereit
.