Bytecode Alliance Wasmtime up to 46.0.1/47.0.2 Fuel/Epoch Preemption Checks epoch_deadline_callback heap-based overflow

Summaryinfo

A vulnerability marked as problematic has been reported in Bytecode Alliance Wasmtime up to 46.0.1/47.0.2. Affected by this vulnerability is the function Store::epoch_deadline_callback of the component Fuel/Epoch Preemption Checks. Performing a manipulation results in heap-based overflow. This vulnerability was named CVE-2026-104855. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Bytecode Alliance Wasmtime up to 46.0.1/47.0.2. This affects the function Store::epoch_deadline_callback of the component Fuel/Epoch Preemption Checks. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on integrity, and availability. The summary by CVE is:

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store<T>, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-104855 since 10/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 46.0.2 or 47.0.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Bytecode Alliance

Name

• Wasmtime

Version

• 46.0.0
• 46.0.1
• 47.0.0
• 47.0.1
• 47.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion