CVE-2026-119139— Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Quick assessment

Affected

bytecodealliance wasmtime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wasmtime 46.0.0 至 48.0.6 之前的版本，以及 49.0.0 至 49.0.3 之前的版本，在函数中遗留了一个断言，该断言会拒绝使用异步 ABI 选项的客方导出。如果攻击者提供一个包含异步提升导出的组件，当嵌入程序通过调用该导出时，将导致宿主进程崩溃。

CVSS 4.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Source: CVE Program / CVE List V5

Vulnerability Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bytecodealliance	wasmtime	46.0.0 ~ 48.0.6	-

II. Public POCs for CVE-2026-119139

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119139

请登录查看更多情报信息。

Other References for CVE-2026-119139 (2)

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-func-call third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119139

Same Patch Batch · bytecodealliance · 2026-10-29 · 14 CVEs total

CVE-2026-119134	6.2 MEDIUM	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory G
CVE-2026-119137	5.3 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry
CVE-2026-119141	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc
CVE-2026-119131	5.3 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http
CVE-2026-119142	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
CVE-2026-119138	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
CVE-2026-119143	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
CVE-2026-119136	4.8 MEDIUM	Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass
CVE-2026-119140	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
CVE-2026-119132	4.8 MEDIUM	Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
CVE-2026-119135	4.8 MEDIUM	Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatc
CVE-2026-119133	2.6 LOW	Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception
CVE-2026-119130	2.6 LOW	Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Targe

IV. Related Vulnerabilities

Same product: wasmtime

Same vendor: bytecodealliance

Same weakness: CWE-617