Wasmtime: Stack buffer overflow via mistyped component-model-async callbacks
Summary
Wasmtime, a WebAssembly runtime used as a library in other software, does not validate the return types of component-model-async callback functions. A malicious guest component can write about 16 KB to the host's native stack and overwrite return addresses. This can crash the host process or allow an escape from the WebAssembly sandbox. The attack requires that the embedding software loads untrusted or third-party WebAssembly components.
Affected
- Wasmtime 39.0.0 to before 48.0.4
- Wasmtime 49.0.0 to before 49.0.2
- Affected products are those that embed these Wasmtime versions, for example plugin systems or edge functions. Check lockfiles and vendored binaries for wasmtime.
Fixed in
- Upgrade to Wasmtime 48.0.4 or 49.0.2 (per the GitHub advisory).
- Use the vendor's later build for any product that embeds Wasmtime.
Workaround
- Disable the component-model-async feature. Wasmtime then rejects components that use async features, including async callbacks.
- Alternatively, validate components with wasmparser v1.260.0 or later and reject invalid ones before they reach Wasmtime.
Exploitation
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- No known exploitation found in the sources reviewed. The CISA KEV catalogue was not checked directly.
- No public proof of concept found.
- CVSS 9.4 (v4.0, critical) per the CVE record. Analysts differ on the v4 vector.
Our recommendation
- Inventory systems and applications for wasmtime, including Rust crates, Python wheels and vendored binaries.
- Upgrade to 48.0.4 or 49.0.2, or confirm that your product vendor has shipped the fix.
- If patching is not possible quickly, disable component-model-async or accept only trusted components.
- Check the advisories of your product vendors, as downstream packages may lag behind the upstream fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-32h6-97mm-8q3c github.com
- VulnCheck Advisory www.vulncheck.com
- Wasmtime release v49.0.2 github.com
- OSV RUSTSEC-2026-0327 osv.dev
- Ubuntu security notice CVE-2026-115384 ubuntu.com
- VulDB entry 425442 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:55.
Original description (NVD)
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.