CVE-2026-115384 in Wasmtime
Summary
by MITRE • 10/23/2026
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within Wasmtime versions 39.0.0 through 48.0.4 and version 49.0.0 prior to patch release 49.0.2, representing a critical stack buffer overflow condition that compromises the integrity of the WebAssembly runtime environment. This flaw is specifically triggered during the handling of asynchronous callback result types within the component model interface. When Wasmtime processes components that define async callbacks, it relies on strict type validation to ensure that data passed between the guest and host adheres to expected memory layouts and size constraints. In the affected versions, this validation mechanism contains a logical gap where certain mistyped or malformed component-model-async callback functions are not properly sanitized before being processed by the native execution engine.
The technical root cause of this vulnerability is an unvalidated input path that allows malicious guests to write approximately sixteen kilobytes directly onto the native stack of the host process. In standard WebAssembly execution, memory isolation is maintained through a linear heap and strict bounds checking on data access. However, when async callbacks are invoked, control flow transitions between the guest environment and the native host code. The vulnerability arises because the runtime fails to verify that the result types returned by these asynchronous operations fit within the expected stack frame boundaries. Consequently, an attacker can craft a WebAssembly component with deliberately mistyped callback signatures that exceed the allocated space on the native call stack. This overflow allows for arbitrary write access to adjacent memory locations, including critical control data such as return addresses and saved register states.
The operational impact of this vulnerability is severe, enabling two primary attack vectors: denial of service and potential remote code execution via sandbox escape. By overwriting return addresses or other control flow indicators on the stack, an attacker can force the Wasmtime host process to crash, resulting in a straightforward denial of service against any application relying on the WebAssembly runtime for secure computation. More critically, if the overflow is carefully controlled and combined with additional exploitation techniques such as heap spraying or specific memory layout knowledge, it may allow an attacker to redirect execution flow outside the sandboxed environment. This effectively breaks the fundamental security boundary that Wasmtime provides, allowing malicious code to execute arbitrary instructions on the host system with the privileges of the running process.
This vulnerability aligns closely with CWE-121, which describes a stack-based buffer overflow where data is written beyond the allocated space due to insufficient bounds checking. Furthermore, from an adversary perspective, this flaw facilitates techniques categorized under MITRE ATT&CK T1059, specifically command and script interpreter abuse or execution via native API calls, as it enables the bypass of sandbox restrictions. The exploitation relies on manipulating the component model interface, which is a higher-level abstraction layer in WebAssembly that allows for more complex interactions between modules than traditional linear memory access.
Mitigation strategies must prioritize immediate software updates to address this critical flaw. Organizations and developers utilizing Wasmtime should upgrade to version 48.0.5 or later, as well as version 49.0.2 and subsequent releases, where the input validation logic for async callback result types has been corrected. Until an update is applied in environments that cannot be immediately patched, runtime configurations should restrict untrusted WebAssembly components from invoking complex asynchronous callbacks with dynamic type signatures. Additionally, enabling stack canaries and Address Sanitizer features during development phases can help detect such overflow conditions earlier in the software lifecycle. Continuous monitoring of host process stability and memory usage patterns may also provide early indicators of exploitation attempts targeting this specific vulnerability vector.