Bytecode Alliance Wasmtime up to 24.0.11/36.0.12/46.0.1/47.0.2 Store APIs new type confusion

Summaryinfo

A vulnerability classified as problematic has been found in Bytecode Alliance Wasmtime up to 24.0.11/36.0.12/46.0.1/47.0.2. This impacts the function Instance::new/StructRefPre::new/Tag::new of the component Store APIs. Performing a manipulation results in type confusion. This vulnerability is known as CVE-2026-115393. Attacking locally is a requirement. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Bytecode Alliance Wasmtime up to 24.0.11/36.0.12/46.0.1/47.0.2. It has been classified as problematic. This affects the function Instance::new/StructRefPre::new/Tag::new of the component Store APIs. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-115393 since 10/22/2026. The exploitability is told to be easy. An attack has to be approached locally. The exploitation requires an enhanced level of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 24.0.12, 36.0.13, 46.0.2 or 47.0.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Bytecode Alliance

Name

• Wasmtime

Version

• 24.0.0
• 24.0.1
• 24.0.2
• 24.0.3
• 24.0.4
• 24.0.5
• 24.0.6
• 24.0.7
• 24.0.8
• 24.0.9
• 24.0.10
• 24.0.11
• 36.0.0
• 36.0.1
• 36.0.2
• 36.0.3
• 36.0.4
• 36.0.5
• 36.0.6
• 36.0.7
• 36.0.8
• 36.0.9
• 36.0.10
• 36.0.11
• 36.0.12
• 46.0.0
• 46.0.1
• 47.0.0
• 47.0.1
• 47.0.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion