CVE-2026-119139 in Wasmtimeinfo

Summary

by MITRE • 10/29/2026

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

10/29/2026

Disclosure

10/29/2026

Moderation

accepted

EPSS

0.00000

KEV

no

Activities

very low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-119139
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-119139
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-119139/

◂ PreviousOverviewNext ▸

Want to know what is going to be exploited?

We predict KEV entries!