CVE-2026-115393

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 24.0.12 Wasmtime versions 25.0.0 through 36.0.12 Wasmtime versions 37.0.0 through 46.0.1 Wasmtime versions 47.0.0 through 47.0.2

Description A type confusion issue exists because several Store APIs do not validate whether objects belong to the Store's Engine. When embedders mix objects between Engines using the functions Instance::new(), StructRefPre::new(), or Tag::new(), it can lead to trampoline signature mismatches. This may result in out-of-bounds stack writes, GC heap corruption, or panics.

Recommendations Update to version 24.0.12 or later. Update to version 36.0.13 or later. Update to version 46.0.2 or later. Update to version 47.0.3 or later.