Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion
Impact
Wasmtime versions before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contain a type confusion vulnerability. This may cause out-of-bounds stack writes, GC heap corruption, or panics when mixing objects between Engines.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
bytecodealliance · VulnCheck
wasmtime
8 ranges
bytecodealliance · VulnCheck
wasmtime
Package identity
pkg:cargo/wasmtimeExplore wasmtime →Identity supplied by VulnCheck. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 24.0.12
semver versions
25.0.0 → before 36.0.13
semver versions
37.0.0 → before 46.0.2
semver versions
47.0.0 → before 47.0.3
semver versions
unaffected
24.0.12
semver versions
36.0.13
semver versions
46.0.2
semver versions
47.0.3
semver versions
Other versions: unaffected
Original source description
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115393View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
VulnCheck · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*Before: 24.0.12
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*From (inclusive): 25.0.0
Before: 36.0.13
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*From (inclusive): 37.0.0
Before: 46.0.2
Vulnerable product
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*From (inclusive): 47.0.0
Before: 47.0.3
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "24.0.12"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.0.0",
"versionEndExcluding": "36.0.13"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "37.0.0",
"versionEndExcluding": "46.0.2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "47.0.0",
"versionEndExcluding": "47.0.3"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.