Read the docs
TI-2026-82651 Aliases CVE-2026-119133GHSA-9283-62cg-q26h

Wasmtime VMContext misalignment with odd exception tag counts

Priority LOW 11CWE-758Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Wasmtime from 47.0.0 before 48.0.6 and from 49.0.0 before 49.0.3 contains a memory misalignment flaw in its VMContext layout, which causes undefined behavior (CWE-758). A WebAssembly module with an odd number of exception tags misaligns subsequent host fields in embedders with exceptions enabled. No exploitation path is currently known.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 48.0.6, 49.0.3Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtime47.0.0 to before 48.0.6; 49.0.0 to before 49.0.348.0.6, 49.0.3Patch availableCNA
  • wasmtime Vendorbytecodealliance Affected 47.0.0 to before 48.0.6; 49.0.0 to before 49.0.3 Fixed in 48.0.6, 49.0.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*——bytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Upgrade Wasmtime to 48.0.6 or 49.0.3. Red Hat gives no fix plan for Red Hat Connectivity Link 1 and Red Hat Enterprise Linux 10, which are listed as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 48.0.6, 49.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    bytecodealliance wasmtime 48.0.6, 49.0.3

    11 records Highest priority Priority LOW 11 LOW

    Other records, highest priority first

    • TI-2026-82659 Wasmtime realloc reentrancy lets Wasm modules crash the hostPriority LOW 37
    • TI-2026-82655 Stack overflow in Wasmtime via type registry lets guests crash hostPriority LOW 37
    • TI-2026-82649 Integer overflow in Wasmtime wasi-http lets guests crash the hostPriority LOW 36
    Show all 11 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119133
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Alias added: GHSA-9283-62cg-q26h
  4. 2026-10-30 Affected versions changed · Red Hat
  5. 2026-10-30 CVSS score added · Red Hat

References

Advisory 1

  • TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences