CVE-2026-115892 · GHSA-9pvw-hwfg-92h5
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
- Risk score
- 43/100
- CVSS
- 5.7 v4.0
- Exploit chance (30 days)
- 0.6%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed r…
- Affected
- wasmtime (rust) >= 46.0.0, < 48.0.7; wasmtime (rust) >= 49.0.0, < 49.0.4
- Fix
- Upgrade wasmtime to 48.0.7 or 49.0.4 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
wasmtime: Amber, patch this week. A vulnerability in the Cranelift compiler backend of Wasmtime allows attackers to cause silent overflow and miscompilation, potentially escaping the Wasm sandbox. This can lead to arbitrary miscompilation, type confusion, and other attacker-controlled effects.
The flaws
- CVE-2026-115892: Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7 · EPSS 1%)
- CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9 · EPSS 1%)
The fix
Upgrade wasmtime: 48.0.7 · 49.0.4 · 36.0.19 · 43.0.0 or later on your release line
Who is exposed: {'products': ['Wasmtime'], 'packages': [{'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '< 36.0.19', 'patched': '36.0.19'}, {'ecosystem': 'rust', 'name': 'wasmtime', 'vulnerable': '>= 37.0.0, < 43.0.0', 'patched': '43.0.0'}], 'versions': ['< 36.0.19', '>= 37.0.0, < 43.0.0']}
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-843 (CWE-843). 60 other warnings in 30 days
Why it is Yellow
- CVSS 5.7 medium
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| wasmtime | rust | >= 46.0.0, < 48.0.7 | 48.0.7 |
| wasmtime | rust | >= 49.0.0, < 49.0.4 | 49.0.4 |
References
- https://github.com/advisories/GHSA-9pvw-hwfg-92h5
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5
- https://github.com/bytecodealliance/wasmtime/pull/14819
- https://github.com/bytecodealliance/wasmtime/pull/14820
- https://github.com/bytecodealliance/wasmtime/pull/14827
- https://github.com/bytecodealliance/wasmtime/commit/222ff3a65dab9aa7011f8c246937751a0bac5abd
- https://github.com/bytecodealliance/wasmtime/commit/48dacc76241f06088e79f3ce1b17642f2f7bf158
- https://github.com/bytecodealliance/wasmtime/commit/994549891c8a706cb4f2809f9d17b9f67b31e618
- https://github.com/bytecodealliance/wasmtime/releases/tag/v48.0.7
- https://github.com/bytecodealliance/wasmtime/releases/tag/v49.0.4
Original description
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest expecting a different payload type, which panics the Wasmtime host. This issue is fixed in versions 48.0.7 and 49.0.4.
Last activity 23 Oct 2026. Patch Forecast updates every hour.