CVE-2026-115393

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion

State: Published
Severity: 1.0 Low
Published: Oct 22, 2026
Updated: Oct 29, 2026
Reserved: Oct 22, 2026

Read the record on cve.org

Description

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.

Scores

CVSS	Score	Vector	Source
4.0	1.0 Low	CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	3.8 Low	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L	VulnCheck

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
wasmtimebytecodealliance	before 24.0.12Affected 24.0.12Not affected 25.0.0 to before 36.0.13Affected 36.0.13Not affected 37.0.0 to before 46.0.2Affected 46.0.2Not affected 47.0.0 to before 47.0.3Affected 47.0.3Not affected

References

GitHub Security Advisory (GHSA-hgjw-h833-99q9)vendor-advisory
VulnCheck Advisory: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.