CVE-2026-115383 bytecodealliance CVE debrief

Who should care

Roles: Developers and administrators using Wasmtime in their applications, especially those executing untrusted WebAssembly code. Deployment contexts: Environments with Wasmtime versions between 47.0.0 and 48.0.4 or 49.0.0 and 49.0.2.

Why it matters

CVE-2026-115383 is a vulnerability in Wasmtime related to mis-typed WebAssembly tag imports, potentially causing GC heap corruption. Defenders should assess exposure, especially in environments executing untrusted WebAssembly code, and prioritize updates to fixed versions.

• Potential GC heap corruption leading to application instability.
• Need for verification of Wasmtime versions in use.
• Possible impact on systems executing untrusted WebAssembly code.
• Prioritization of updates to fixed Wasmtime versions.

Technical summary

The vulnerability arises from mis-typed WebAssembly tag imports in Wasmtime, potentially leading to GC heap corruption. Affected versions include those between 47.0.0 and 48.0.4 and 49.0.0 and 49.0.2. The CVSS score is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. Defenders should assess exposure, especially in environments executing untrusted WebAssembly code, and prioritize updates to fixed versions. The advisory indicates that the vulnerability affects Wasmtime versions between 47.0.0 and 48.0.4 and 49.0.0 and 49.0.2.

Defensive priority

Assess exposure and prioritize verification of Wasmtime versions in use, focusing on environments where untrusted WebAssembly code is executed.

Recommended defensive actions

• Inventory Wasmtime deployments to identify potentially affected versions.
• Verify if untrusted WebAssembly code is executed in affected environments.
• Prioritize updating Wasmtime to fixed versions (48.0.4 or 49.0.2) where possible.
• Monitor for potential GC heap corruption incidents in Wasmtime deployments.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The advisory indicates that the vulnerability affects Wasmtime versions between 47.0.0 and 48.0.4 and 49.0.0 and 49.0.2. However, specific version details and potential exploits remain limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.