CVE-2026-119143 in Wasmtime
Summary
by MITRE • 10/29/2026
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Wasmtime versions prior to 48.0.6 for the 46.x series and prior to 49.0.3 for the 49.x series represents a critical denial of service flaw within the WebAssembly runtime environment. This issue specifically affects implementations that utilize the WASIp3 interface, which is part of the broader effort to standardize system-level APIs for WebAssembly components. The core of the vulnerability lies in how the runtime handles stream operations involving zero-length data transfers when accompanied by unvalidated memory addresses. In a secure implementation, any interaction with host resources must undergo rigorous boundary checks and address validation before execution proceeds. However, in these affected versions, the logic governing out-of-bounds zero-length stream reads or writes fails to properly validate the target addresses against the allocated memory space of the guest component.
From a technical perspective, this flaw allows malicious guest code to trigger a host panic by exploiting the internal handling mechanisms for DirectSource and DirectDestination objects within the WASIp3 implementation. When a guest module attempts to perform a stream operation with zero length but specifies an address that falls outside valid bounds or is otherwise unvalidated, the runtime does not gracefully handle this edge case. Instead, it proceeds to evaluate the remaining capacity of these streams using internal methods such as DirectSource::remaining and DirectDestination::remaining. Because the addresses are invalid, these method calls encounter unexpected states within their logic, leading directly to a panic condition in the host process rather than returning an appropriate error code or rejecting the operation safely. This behavior effectively turns a standard API call into a vector for crashing the entire runtime environment hosting the WebAssembly component.
The operational impact of this vulnerability is severe due to its potential for remote exploitation and service disruption. Since Wasmtime is often deployed in server-side environments, cloud functions, or edge computing nodes where multiple untrusted WebAssembly modules may be executed concurrently, a single malicious guest can cause a denial of service by crashing the host process. This crash results in immediate downtime for any services relying on that specific instance of the runtime. Furthermore, because the vulnerability is triggered through standard stream operations, it does not require complex exploitation techniques or privilege escalation beyond what is already granted to the WebAssembly sandbox. An attacker can simply craft a component that issues these malformed zero-length requests repeatedly or strategically to ensure host instability, thereby compromising the availability and reliability of the infrastructure hosting the application.
This vulnerability aligns with CWE-20 Improper Input Validation, as the root cause is the failure to adequately verify input parameters before processing them within critical system functions. Additionally, it maps to ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or application crashes through malformed inputs. The exploitation path leverages the trust model inherent in WebAssembly execution environments where guest code is expected to be sandboxed but may still interact with host resources via defined APIs like WASIp3.
To mitigate this risk, organizations running Wasmtime must immediately upgrade to version 48.0.6 or later for the 46.x branch and version 49.0.3 or later for the 49.x branch. These releases contain patches that enforce strict validation of addresses during stream operations, ensuring that out-of-bounds access attempts are caught early in the execution pipeline without triggering host-level panics. In addition to upgrading, developers should implement defense-in-depth strategies by validating inputs at the application layer before they reach the WebAssembly runtime where possible. Monitoring logs for panic traces or unexpected process terminations can also aid in detecting potential exploitation attempts while migration efforts are underway. Ensuring that all dependencies and embedded runtimes are kept up-to-date is essential to maintaining the integrity of systems relying on Wasmtime for secure execution of untrusted code.