What’s Vulnerable › Vulnerabilities

CVE-2026-115379: Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-22
• Weakness: CWE-416

Description

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

Affected products

• bytecodealliance wasmtime: from 47.0.0 before 48.0.4; from 49.0.0 before 49.0.2 — fixed in 48.0.4, 49.0.2

How to fix

Upgrade to a fixed version: bytecodealliance wasmtime 48.0.4, 49.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf
• https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-try-call

Get alerted when CVE-2026-115379 or the next vulnerability affects your stack