CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115384?
CVE-2026-115384 is a critical vulnerability in bytecodealliance wasmtime, published on 22 Oct 2026.
Official description
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Weakness: CWE-20
Which versions are affected by CVE-2026-115384?
1 open source package ship an affected version, including wasmtime.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 39.0.0 | 48.0.4, 49.0.2 |
How do I fix CVE-2026-115384?
Upgrade wasmtime to a fixed version for your release line: 48.0.4 or 49.0.2.
Is CVE-2026-115384 being exploited?
There is no known exploitation of CVE-2026-115384 in the wild and no public exploit code.
Sources
Also known as AZL-111011, AZL-111026, AZL-111077, AZL-111086, GHSA-32h6-97mm-8q3c, GHSA-6fff-wrjr-wjxr and 2 more.