CVE-2026-119133

EUVD-2026-113200
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
2.6 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
bytecodealliancewasmtime
47.0.0 ≤
𝑥
< 48.0.6
CNA
bytecodealliancewasmtime
49.0.0 ≤
𝑥
< 49.0.3
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-wasmtime
forky
36.0.13+dfsg-1
fixed
sid
36.0.13+dfsg-1
fixed
trixie
26.0.1+dfsg-3
fixed
Common Weakness Enumeration
References
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp
https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.6-and-49.0.0-before-49.0.3-misaligned-vmcontext-via-exception-tags