Denial of Service Vulnerability in Wasmtime Affected by Out-of-Bounds Stream Operations

CVE-2026-119143

What is CVE-2026-119143?

The vulnerability found in Wasmtime versions prior to 48.0.6 and 49.0.3 allows malicious guest code to exploit out-of-bounds zero-length stream operations. By performing unvalidated address stream reads or writes, attackers can trigger a panic in Direct{Source,Destination}::remaining functionality, leading to crashes in embedded WASIp3 environments. This could result in service disruptions and impact the integrity of the system hosting Wasmtime.

References