Wasmtime: Cross-engine type confusion with host-created struct-types-with-supertypes
Affects wasmtimeSource GCVE Database
Fixed in 50.0.1 : update wasmtime when convenient.
Data as of 30 Oct 2026, 11:16 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 50.0.1, 49.0.5, 48.0.8
What to do
Upgrade wasmtime to 50.0.1, 49.0.5 or 48.0.8.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iowasmtimepkg:cargo/wasmtimeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available and has been released in Wasmtime versions 48.0.8, 49.0.5, and 50.0.1. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided in the advisory.
Description
A vulnerability in Wasmtime involving cross-engine type confusion with host-created struct types that have supertypes. This flaw affects multiple versions of Wasmtime prior to fixed releases. It was addressed in versions 48.0.8, 49.0.5, and 50.0.1.