CVE-2026-119138— Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap

Quick assessment

Affected

bytecodealliance wasmtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wasmtime 46.0.0 至 48.0.6 之前的版本，以及 49.0.0 至 49.0.3 之前的版本，存在一个拒绝服务（DoS）漏洞。该漏洞允许在 Store（存储）因异常（trap）而被污染后，待处理的调用触发断言失败。攻击者通过提供行为异常的 Guest 代码，可引发异常并让此前的调用继续执行，从而导致仍在使用该不一致 Store 的嵌入程序（embedders）崩溃。

CVSS 4.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap

Source: CVE Program / CVE List V5

Vulnerability Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasmtime	46.0.0 ~ 48.0.6	-

II. Public POCs for CVE-2026-119138

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119138

请登录查看更多情报信息。

Other References for CVE-2026-119138 (2)

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-after-trap third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119138

Same Patch Batch · bytecodealliance · 2026-10-29 · 14 CVEs total

CVE-2026-119134	6.2 MEDIUM	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory G
CVE-2026-119137	5.3 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119141	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119131	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119142	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-119143	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119136	4.8 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119140	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119132	4.8 MEDIUM	Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119139	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
CVE-2026-119135	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatc
CVE-2026-119133	2.6 LOW	Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception
CVE-2026-119130	2.6 LOW	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Targe

IV. Related Vulnerabilities

Same product: wasmtime

Same vendor: bytecodealliance

Same weakness: CWE-617