Medium severity · published Oct 29, 2026
CVE-2026-119141
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
New
5.3
CVSS
–
EPSS
No
On KEV
Description
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wasmtime · bytecodealliance
46.0.0 before 48.0.6; 49.0.0 before 49.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119141
vendor-advisory
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7
third-party-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-realloc
More from wasmtime
10.0
CVE-2024-51745
Wasmtime doesn't fully sandbox all the Windows device filenames
9.9
CVE-2026-115893
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
9.9
CVE-2026-115889
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
9.9
CVE-2026-115384
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
9.9
CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access