A critical stack buffer overflow in Wasmtime's component-model async callback handling could let a malicious WebAssembly guest overwrite the host's native stack. That could crash the host or let the guest escape the sandbox.
What Is It
CVE-2026-115384 is a stack buffer overflow in Wasmtime, the WebAssembly runtime from the Bytecode Alliance. Wasmtime does not validate the result types returned by async callbacks. A malicious guest can supply a component whose component-model-async callback functions have the wrong types. According to the advisory, this can let it write about 16KB to the native stack and overwrite return addresses.
The weakness is classified as CWE-20 (Improper Input Validation). VulnCheck, the CVE Numbering Authority, published the CVE on 2026-10-22. NVD lists its status as "Deferred."
Why It Matters
Wasmtime is built to isolate untrusted guest code from the host. This flaw could undermine that isolation. According to the advisory, an attacker who can supply a component could crash the host or potentially escape the sandbox.
The CNA rated it critical:
- CVSS 3.1: 9.9 (Critical),
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector describes a network-reachable, low-complexity attack that needs low privileges and no user interaction. The scope is "changed," meaning the potential impact reaches beyond the vulnerable component. - CVSS 4.0: 9.4 (Critical), with high potential impact to both the vulnerable system and subsequent systems.
Any platform that runs third-party or user-supplied WebAssembly components on an affected Wasmtime version should treat this as high priority.
Exploitation status: No CISA KEV entry was supplied for this CVE, so active exploitation has not been confirmed in the source data.
What's Vulnerable
The affected package is wasmtime (pkg:cargo/wasmtime) from the Bytecode Alliance:
- Affected: 39.0.0 up to (but not including) 48.0.4
- Affected: 49.0.0 up to (but not including) 49.0.2
- Unaffected: 48.0.4 and 49.0.2
Versions outside these ranges are listed as unaffected by default. Exposure likely depends on running guest components that use component-model-async callbacks.
Patch Status
The vendor data lists fixed versions on both affected release lines:
- 48.x line: upgrade to 48.0.4
- 49.x line: upgrade to 49.0.2
Rust projects that depend on the wasmtime crate should update the dependency, rebuild, and redeploy. Embedded or transitive copies also need to move to a fixed version. Check the GitHub security advisory for full vendor guidance. The source data does not include any CISA KEV required action or due date.