CVE-2026-126407
EUVD-2026-12503613.11.2026, 10:17
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component can repeatedly transfer such borrowed resources to consume arbitrary host memory, causing denial of service.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| bytecodealliance | wasmtime | 𝑥 < 36.0.20 | CNA |
| bytecodealliance | wasmtime | 37.0.0 ≤ 𝑥 < 48.0.8 | CNA |
| bytecodealliance | wasmtime | 49.0.0 ≤ 𝑥 < 49.0.5 | CNA |
| bytecodealliance | wasmtime | 50.0.0 ≤ 𝑥 < 50.0.1 | CNA |