CVE-2026-115892

Name of the Vulnerable Software and Affected Versions Wasmtime versions 46.0.0 through 48.0.6 Wasmtime versions 49.0.0 through 49.0.3

Description A flaw exists when lowering a host-created component-model stream or future into a guest. The system may omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass a type-erased value to a guest expecting a different payload type, resulting in a host panic and a denial of service. This specifically affects embedders that create streams or futures using StreamReader::new or FutureReader::new, pass them to guest code, receive them back as type-erased values, and subsequently pass them to a guest function with a differing payload type.

Recommendations Update Wasmtime to version 48.0.7. Update Wasmtime to version 49.0.4.