Wasmtime (< 24.0.13, >= 25.0.0 < 36.0.14, >= 37.0.0 < 46.0.3, >= 47.0.0 < 47.0.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wasmtime--24.0.13--25.0.0--36.0.14--37.0.0--46.0.3--47.0.0--47.0.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:27:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWasmtime: Stack buffer overflow in async callback handling (CVE-2026-115384)https://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/Thu, 22 Oct 2026 20:27:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wasmtime-stack-overflow/Wasmtime versions prior to 48.0.4 and 49.0.2 are vulnerable to a stack buffer overflow allowing sandbox escape or host crashes via unvalidated async callback result types.Wasmtime contains a stack buffer overflow vulnerability (CVE-2026-115384) in its component model implementation. Malicious guests can exploit improper validation of async callback result types to write approximately 16KB of data to the native stack. This allows for the overwriting of return addresses, which can lead to host process crashes or a full sandbox escape. The vulnerability affects Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1.

Impact

Successful exploitation may result in arbitrary code execution outside the WebAssembly sandbox, enabling an attacker to compromise the host system, or causing immediate termination of the host process (Denial of Service).

Recommendation

  • Upgrade Wasmtime to version 48.0.4 or 49.0.2 immediately.
  • Audit WebAssembly components loaded into the environment to ensure they originate from trusted sources.
  • If immediate patching is not possible, implement stricter runtime sandboxing or containerization around Wasmtime-powered services to limit the impact of a potential sandbox escape.
]]>criticaladvisory