CVE-2026-115379: wasmtime 47.0.0 to before 48.0.4, 49.0.0 to before 49.0.2

Affected technology

wasmtime · 47.0.0 to before 48.0.4, 49.0.0 to before 49.0.2
bytecodealliance

Description’s affected range: before 48.0.4 and 49.0.0 before 49.0.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as high.