Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck
CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
Medium 4.8
In plain English
A medium-severity security flaw in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 92.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115383 |
| Ubuntu:26.04:LTS | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115383 |
| Ubuntu:26.10 | rust-wasmtime | no fix listed | UBUNTU-CVE-2026-115383 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bytecodealliance | wasmtime | 47.0.0 – before 48.0.449.0.0 – before 49.0.2 |
Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H