CVE-2026-115379

Name of the Vulnerable Software and Affected Versions Wasmtime versions 47.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description A missing GC rooting issue occurs when compiling Wasm modules, leaving references live across try call unrooted. This allows attackers to provide Wasm modules where the callee triggers garbage collection (GC), resulting in stale or dangling references. Such a condition can lead to GC heap corruption or incorrect execution.

Recommendations Update Wasmtime versions 47.0.0 through 48.0.3 to version 48.0.4. Update Wasmtime versions 49.0.0 through 49.0.1 to version 49.0.2.