CVE-2026-119135— Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

Quick assessment

Affected

bytecodealliance wasmtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Wasmtime 46.0.0 至 48.0.6（不含）以及 49.0.0 至 49.0.3（不含）版本中，当主机（host）将组件模型流（component model stream）读取为与其创建时不同的 Rust 类型时，会触发 panic。这是因为主机到主机的读取路径在类型 ID（TypeId）不匹配时执行了断言，而非返回错误。恶意或被利用的 Guest 代码可以返回一个由主机创建的，而嵌入者（embedder）却将其作为进行读取；尽管这两种类型在组件模型层面映射为同一类型，但 Rust 类型 ID

CVSS 4.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

Source: CVE Program / CVE List V5

Vulnerability Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasmtime	46.0.0 ~ 48.0.6	-

II. Public POCs for CVE-2026-119135

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119135

请登录查看更多情报信息。

Other References for CVE-2026-119135 (2)

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-streamreader-type-mismatch third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119135

Same Patch Batch · bytecodealliance · 2026-10-29 · 14 CVEs total

CVE-2026-119134	6.2 MEDIUM	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory G
CVE-2026-119137	5.3 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119141	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119131	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119142	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-119138	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-119143	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119136	4.8 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119140	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119132	4.8 MEDIUM	Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119139	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-119133	2.6 LOW	Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception
CVE-2026-119130	2.6 LOW	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Targe

IV. Related Vulnerabilities

Same product: wasmtime

Same vendor: bytecodealliance

Same weakness: CWE-617