Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
Impact
Wasmtime versions 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contain a stack buffer overflow vulnerability, allowing malicious guests to write to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped callback functions to overwrite return addresses. This may crash the host or escape the sandbox.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
bytecodealliance · VulnCheck
wasmtime
4 ranges
bytecodealliance · VulnCheck
wasmtime
Package identity
pkg:cargo/wasmtimeExplore wasmtime →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
39.0.0 → before 48.0.4
semver versions
49.0.0 → before 49.0.2
semver versions
unaffected
48.0.4
semver versions
49.0.2
semver versions
Other versions: unaffected
Original source description
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115384View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*From (inclusive): 39.0.0
Before: 48.0.4
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*From (inclusive): 49.0.0
Before: 49.0.2
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "39.0.0",
"versionEndExcluding": "48.0.4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "49.0.0",
"versionEndExcluding": "49.0.2"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.