CVE-2026-115379

EUVD-2026-108302
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.7 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.13%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
bytecodealliancewasmtime
47.0.0 ≤
𝑥
< 48.0.4
CNA
bytecodealliancewasmtime
49.0.0 ≤
𝑥
< 49.0.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-wasmtime
forky
36.0.13+dfsg-1
fixed
sid
36.0.13+dfsg-1
fixed
trixie
26.0.1+dfsg-3
fixed
Common Weakness Enumeration
References
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf
https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-try-call