CVE-2026-119133 in Wasmtime
Summary
by MITRE • 10/29/2026
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with exceptions enabled, although no exploitation path is currently known.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within Wasmtime versions 47.0.0 through 48.0.5 and 49.0.0 through 49.0.3 stems from a structural misalignment in the Virtual Machine Context layout, specifically triggered by WebAssembly modules that define an odd number of exception tags. This flaw is rooted in how the runtime allocates memory for host-side fields associated with exceptions when such features are enabled within the embedding environment. The underlying technical issue involves incorrect padding or alignment calculations during the initialization of the VMContext structure, which leads to a shift in the expected memory offsets for subsequent data structures. When a module contains an odd count of exception tags, the resulting layout misaligns these host fields, causing undefined behavior upon execution. Undefined behavior in systems programming contexts such as WebAssembly runtimes is particularly dangerous because it can lead to unpredictable outcomes including crashes, data corruption, or potentially arbitrary code execution if the memory state becomes sufficiently compromised.
From a security architecture perspective, this vulnerability aligns with CWE-120 Buffer Overflow and CWE-787 Out-of-bounds Write depending on how the misaligned access manifests in specific host implementations. The core issue is a failure to maintain proper memory alignment constraints required by both the WebAssembly specification and the underlying hardware or operating system expectations for efficient and safe data access. While the immediate manifestation is undefined behavior, the lack of strict bounds checking during context initialization allows for potential exploitation vectors that could bypass standard sandboxing mechanisms inherent in Wasmtime. The ATT&CK framework categorizes such memory corruption issues under techniques related to execution on compromised hosts or privilege escalation if the runtime operates with elevated privileges, although direct exploitation paths are not yet documented.
The operational impact of this vulnerability is significant for applications relying on WebAssembly modules that utilize exception handling features enabled in their host environments. Developers and system administrators must recognize that even without a known exploit chain, undefined behavior poses a severe risk to application stability and security posture. The misalignment can cause subtle bugs that are difficult to reproduce and debug, potentially leading to denial of service conditions through segmentation faults or memory access violations. Furthermore, if the runtime is embedded in a multi-tenant environment such as cloud functions or browser-like contexts, this flaw could theoretically be leveraged for side-channel attacks or information disclosure by manipulating memory layout expectations across different module executions.
Mitigation strategies primarily involve upgrading to patched versions of Wasmtime where 48.0.6 and later releases address the alignment calculation errors in VMContext initialization. For environments unable to upgrade immediately, disabling exception handling features within WebAssembly modules can serve as a temporary workaround since the vulnerability is specifically triggered by odd numbers of exception tags when exceptions are enabled. Security teams should also implement strict input validation for module metadata before loading them into the runtime and monitor logs for signs of memory access violations or undefined behavior indicators. Regular auditing of third-party dependencies and maintaining up-to-date software inventories are critical practices to ensure that such low-level implementation flaws do not compromise broader system security.