Wasmtime: Stack buffer overflow in async callback handling (CVE-2026-115384)
Wasmtime versions prior to 48.0.4 and 49.0.2 are vulnerable to a stack buffer overflow allowing sandbox escape or host crashes via unvalidated async callback result types.
CVE search metadata
CVE search record: CVE-2026-115384. Severity: critical. CVSS: 9.9. KEV: no. Product: Wasmtime (39.0.0 - 48.0.3, 49.0.0 - 49.0.1), Wasmtime (< 24.0.13, >= 25.0.0 < 36.0.14, >= 37.0.0 < 46.0.3, >= 47.0.0 < 47.0.4). Brief: Wasmtime: Stack buffer overflow in async callback handling (CVE-2026-115384). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/
CVE search record: CVE-2026-115392. KEV: no. Product: Wasmtime (39.0.0 - 48.0.3, 49.0.0 - 49.0.1), Wasmtime (< 24.0.13, >= 25.0.0 < 36.0.14, >= 37.0.0 < 46.0.3, >= 47.0.0 < 47.0.4). Brief: Wasmtime: Stack buffer overflow in async callback handling (CVE-2026-115384). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/
Triage facts
Revision 1- Applicability
- Wasmtime (39.0.0 - 48.0.3, 49.0.0 - 49.0.1), Wasmtime (< 24.0.13, >= 25.0.0 < 36.0.14, >= 37.0.0 < 46.0.3, >= 47.0.0 < 47.0.4)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 20:27 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for Wasmtime (< 24.0.13, >= 25.0.0 < 36.0.14, >= 37.0.0 < 46.0.3, >= 47.0.0 < 47.0.4) Oct 22, 20:28 via nvd
Wasmtime contains a stack buffer overflow vulnerability (CVE-2026-115384) in its component model implementation. Malicious guests can exploit improper validation of async callback result types to write approximately 16KB of data to the native stack. This allows for the overwriting of return addresses, which can lead to host process crashes or a full sandbox escape. The vulnerability affects Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1.
Impact
Successful exploitation may result in arbitrary code execution outside the WebAssembly sandbox, enabling an attacker to compromise the host system, or causing immediate termination of the host process (Denial of Service).
Recommendation
- Upgrade Wasmtime to version 48.0.4 or 49.0.2 immediately.
- Audit WebAssembly components loaded into the environment to ensure they originate from trusted sources.
- If immediate patching is not possible, implement stricter runtime sandboxing or containerization around Wasmtime-powered services to limit the impact of a potential sandbox escape.
Immediate actions
Upgrade Wasmtime to version 48.0.4 or 49.0.2 to remediate CVE-2026-115384
Mitigations
Identify and inventory all services running vulnerable versions of Wasmtime
CVE-2026-115384