Vulnerability Description
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-
- https://www.vulncheck.com/advisories/wasmtime-39.0.0-before-48.0.4-and-49.0.0-be
FAQ
What is CVE-2026-115384?
CVE-2026-115384 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback res...
How severe is CVE-2026-115384?
CVE-2026-115384 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-115384?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.