CVE-2026-115383 Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115383?
CVE-2026-115383 is a medium-severity vulnerability in bytecodealliance wasmtime, published on 22 Oct 2026.
Official description
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.
Weakness: CWE-1287
Which versions are affected by CVE-2026-115383?
1 open source package ship an affected version, including wasmtime.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 47.0.0 | 48.0.4, 49.0.2 |
How do I fix CVE-2026-115383?
Upgrade wasmtime to a fixed version for your release line: 48.0.4 or 49.0.2.
Is CVE-2026-115383 being exploited?
There is no known exploitation of CVE-2026-115383 in the wild and no public exploit code.
Sources
Also known as AZL-111008, AZL-111029, AZL-111083, AZL-111089, GHSA-cfhf-m2cr-62wj, GHSA-cvpp-75f3-xc4p and 2 more.