CVE-2026-115384

Name of the Vulnerable Software and Affected Versions Wasmtime versions 39.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description A stack buffer overflow occurs when malicious guests provide mistyped component-model-async callback functions. This allows the writing of approximately 16KB to the native stack via unvalidated async callback result types, which can be used to overwrite return addresses, leading to a host crash or a sandbox escape.

Recommendations Update Wasmtime versions 39.0.0 through 48.0.3 to version 48.0.4. Update Wasmtime versions 49.0.0 through 49.0.1 to version 49.0.2.