{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wasmtime--24.0.13--25.0.0--36.0.14--37.0.0--46.0.3--47.0.0--47.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-115384"},{"id":"CVE-2026-115392"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wasmtime (39.0.0 - 48.0.3, 49.0.0 - 49.0.1)","Wasmtime (\u003c 24.0.13, \u003e= 25.0.0 \u003c 36.0.14, \u003e= 37.0.0 \u003c 46.0.3, \u003e= 47.0.0 \u003c 47.0.4)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Bytecode Alliance"],"content_html":"\u003cp\u003eWasmtime contains a stack buffer overflow vulnerability (CVE-2026-115384) in its component model implementation. Malicious guests can exploit improper validation of async callback result types to write approximately 16KB of data to the native stack. This allows for the overwriting of return addresses, which can lead to host process crashes or a full sandbox escape. The vulnerability affects Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may result in arbitrary code execution outside the WebAssembly sandbox, enabling an attacker to compromise the host system, or causing immediate termination of the host process (Denial of Service).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Wasmtime to version 48.0.4 or 49.0.2 immediately.\u003c/li\u003e\n\u003cli\u003eAudit WebAssembly components loaded into the environment to ensure they originate from trusted sources.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement stricter runtime sandboxing or containerization around Wasmtime-powered services to limit the impact of a potential sandbox escape.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T20:28:46Z","date_published":"2026-10-22T20:27:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/","summary":"Wasmtime versions prior to 48.0.4 and 49.0.2 are vulnerable to a stack buffer overflow allowing sandbox escape or host crashes via unvalidated async callback result types.","title":"Wasmtime: Stack buffer overflow in async callback handling (CVE-2026-115384)","url":"https://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Wasmtime (\u003c 24.0.13, \u003e= 25.0.0 \u003c 36.0.14, \u003e= 37.0.0 \u003c 46.0.3, \u003e= 47.0.0 \u003c 47.0.4)","version":"https://jsonfeed.org/version/1.1"}