CVE-2026-115384: Improper Input Validation in bytecodealliance wasmtime
Description
CVE-2026-115384 is a critical stack buffer overflow vulnerability in bytecodealliance's wasmtime affecting versions 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2. It arises from improper input validation of async callback result types, allowing malicious guests to write approximately 16KB to the native stack. This can lead to crashing the host or escaping the sandbox environment.
CVSS v4.0
Score 9.4critical
Affected software
bytecodealliance
wasmtime
pkg:cargo/github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wasmtime versions 39.0.0 prior to 48.0.4 and 49.0.0 prior to 49.0.2 contain a stack buffer overflow vulnerability due to improper input validation of component-model-async callback result types. Malicious components can supply mistyped async callback functions, enabling them to overwrite return addresses on the native stack by writing around 16KB of data. This vulnerability can cause host crashes or sandbox escapes, posing a critical security risk.
Potential Impact
Successful exploitation allows attackers to overwrite return addresses on the native stack, potentially crashing the host process or escaping the sandbox containment. This compromises the isolation guarantees of the wasmtime runtime, leading to possible arbitrary code execution or denial of service.
Mitigation Recommendations
A fix is available in wasmtime versions 48.0.4 and 49.0.2 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-22T11:25:27.610Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada64a34d27ba8daa756576
Added to database: 10/22/2026, 19:31:47 UTC
Last enriched: 10/22/2026, 20:30:19 UTC
Last updated: 10/22/2026, 21:15:26 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.