CVE-2026-119132 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-119132?
CVE-2026-119132 is a medium-severity vulnerability in bytecodealliance wasmtime, published on 29 Oct 2026.
Official description
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.
Weakness: CWE-617
Which versions are affected by CVE-2026-119132?
1 open source package ship an affected version, including wasmtime.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime crates.io | From 49.0.0 | 49.0.3 |
How do I fix CVE-2026-119132?
Upgrade wasmtime to 49.0.3 or later.
Is CVE-2026-119132 being exploited?
There is no known exploitation of CVE-2026-119132 in the wild and no public exploit code.
Sources
Also known as GHSA-54p9-vhhq-8f7q, GHSA-hv43-9665-59p4, RUSTSEC-2026-0360.