CVE-2026-115892: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') in bytecodealliance wasmtime
Description
CVE-2026-115892 is a medium severity vulnerability in the Wasmtime runtime for WebAssembly. It involves a type confusion issue where a host-created component-model stream or future can omit a required payload-type check after passing through guest code. This can cause the host to panic when a type-erased value is passed to a guest expecting a different payload type. The issue affects Wasmtime versions from 46.0.0 up to but not including 48.0.7, and from 49.0.0 up to but not including 49.0.4. The vulnerability is fixed in versions 48.0.7 and 49.0.4.
CVSS v4.0
Score 5.7medium
Affected software
bytecodealliance
wasmtime
pkg:github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wasmtime versions >=46.0.0 <48.0.7 and >=49.0.0 <49.0.4 have a type confusion vulnerability (CWE-843) in the lowering of host-created component-model streams or futures into guests. Specifically, a required payload-type check can be omitted after values pass through guest code and return via StreamAny, FutureAny, Val::Stream, Val::Future, or equivalent typed readers. A malicious guest controlling exported function types or returned values can cause the host to pass a type-erased value to a guest expecting a different payload type, resulting in a panic of the Wasmtime host. This vulnerability is addressed in versions 48.0.7 and 49.0.4.
Potential Impact
Exploitation of this vulnerability can cause the Wasmtime host to panic, potentially disrupting the execution of WebAssembly code. The vulnerability requires a malicious guest controlling exported function types or returned values. There is no indication of remote code execution or data leakage. The CVSS 4.0 base score is 5.7 (medium severity), reflecting network attack vector, high attack complexity, and partial privileges required.
Mitigation Recommendations
This vulnerability is fixed in Wasmtime versions 48.0.7 and 49.0.4. Users should upgrade to at least these versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-23T19:37:27.176Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adbd340d73cc49347c1efef
Added to database: 10/23/2026, 21:36:00 UTC
Last enriched: 10/23/2026, 21:50:31 UTC
Last updated: 10/23/2026, 21:50:50 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.