Medium severity · published Oct 22, 2026
CVE-2026-115391
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams
New
5.8
CVSS
0.2%
EPSS
No
On KEV
Description
Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that buffers guest-specified-length writes on the host without limit. Malicious guests can offer large buffers to WASIp3 file or HTTP write streams, causing the host to copy and buffer all bytes, bounded only by guest linear memory, exhausting host memory.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wasmtime · bytecodealliance
46.0.0 before 46.0.3; 47.0.0 before 47.0.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115391
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115391
github.com
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759
www.vulncheck.com
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-46.0.3-and-47.0.0-before-47.0.4-unbounded-heap-allocation-via-wasip3-streams
More from wasmtime
10.0
CVE-2024-51745
Wasmtime is a fast and secure runtime for WebAssembly
9.9
CVE-2026-115893
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
9.9
CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access