Type confusion in Wasmtime Store APIs mixing objects across Engines
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Wasmtime before 24.0.12, from 25.0.0 before 36.0.13, from 37.0.0 before 46.0.2, and from 47.0.0 before 47.0.3 is affected. Several Store APIs do not check that objects belong to the Store's Engine, which is a type confusion flaw (CWE-787). An embedder that mixes objects between Engines, for example through Instance::new, can cause out-of-bounds stack writes, GC heap corruption or panics. The attack needs local access, high privileges and passive user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bytecodealliance | wasmtime | before 24.0.12; 25.0.0 to before 36.0.13; 37.0.0 to before 46.0.2; 47.0.0 to before 47.0.3 | 24.0.12, 36.0.13, 46.0.2, 47.0.3 | Patch available | CNA |
- wasmtime Vendorbytecodealliance Affected before 24.0.12; 25.0.0 to before 36.0.13; 37.0.0 to before 46.0.2; 47.0.0 to before 47.0.3 Fixed in 24.0.12, 36.0.13, 46.0.2, 47.0.3 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* | — | — | bytecodealliance |
- cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance
Remediation
Upgrade Wasmtime to version 24.0.12, 36.0.13, 46.0.2 or 47.0.3, matching the affected release line. The sources list no fixed version for Red Hat Connectivity Link 1 or Red Hat Enterprise Linux 10, which are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA wasmtime (bytecodealliance) Fixed in 24.0.12, 36.0.13, 46.0.2, 47.0.3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-22 Threatist record created from CVE-2026-115393
- 2026-10-22 Alias added: GHSA-hm3j-7f84-9x3r
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 CVSS score added · Red Hat
- 2026-10-29 CISA SSVC decision points changed
References
More bytecodealliance vulnerabilities
- TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
- TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
- TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
- TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
- TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
- TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-115393 · CVE Program
- CVE-2026-115393 · NVD
- FIRST EPSS
- GHSA-hm3j-7f84-9x3r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115393 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences