TI-2026-82650 Aliases CVE-2026-119132 GHSA-hv43-9665-59p4

Wasmtime host panic on overlapping string transcoding in adapters

LOW 26CWE-617Published 2026-10-29 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

Wasmtime from 49.0.0 before 49.0.3 contains a flaw in how it transcodes strings in fused adapters, where overlapping source and destination memory triggers a reachable assertion (CWE-617). A WebAssembly guest can make a same-instance component-to-component call that transfers such a string, crashing the host instead of raising a trap, which causes denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00212 11th percentileScored 2026-11-07

Fix Partial wasmtime (bytecodealliance): 49.0.3Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytecodealliance	wasmtime	49.0.0 to before 49.0.3	49.0.3	Patch available	CNA

wasmtime Vendorbytecodealliance Affected 49.0.0 to before 49.0.3 Fixed in 49.0.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:bytecodealliance:wasmtime::::::::	—	—	bytecodealliance

cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Upgrade Wasmtime to version 49.0.3. Red Hat lists Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10 as affected without a fix, with the plan given as none_available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Fix · CNA wasmtime (bytecodealliance) Fixed in 49.0.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Connectivity Link 1	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred

Timeline

2026-10-29 Threatist record created from CVE-2026-119132
2026-10-29 Alias added: GHSA-hv43-9665-59p4
2026-10-30 Affected versions changed · Red Hat
2026-10-30 CVSS score added · Red Hat
2026-10-31 Priority changed: MEDIUM → LOW
2026-11-03 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-54p9-vhhq-8f7q)

TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9

See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences