Skip to content
CVE PROGRAM SOURCE RECORD1.0 Low

CVE-2026-115393

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bytecodealliance wasmtime

Default version status: unaffected

  • 0 to < 24.0.12affected
  • 24.0.12unaffected
  • 25.0.0 to < 36.0.13affected
  • 36.0.13unaffected
  • 37.0.0 to < 46.0.2affected
  • 46.0.2unaffected
  • 47.0.0 to < 47.0.3affected
  • 47.0.3unaffected
pkg:cargo/wasmtime

References