Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-115892Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

Medium 5.7

In plain English

A medium-severity type confusion in wasmtime from bytecodealliance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)5.7Medium
Exploit odds (30 days)0.4%top 62.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:24.04:LTSrust-wasmtimeno fix listedUBUNTU-CVE-2026-115892
Ubuntu:26.04:LTSrust-wasmtimeno fix listedUBUNTU-CVE-2026-115892
Ubuntu:26.10rust-wasmtimeno fix listedUBUNTU-CVE-2026-115892

Affected products (as reported)

VendorProductVersions
bytecodealliance wasmtime >= 46.0.0, < 48.0.7>= 49.0.0, < 49.0.4

Weakness: CWE-843, CWE-248 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References