CVE-2026-115384 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments, particularly those using versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1, should assess exposure and verify patch deployment to mitigate potential risks.

Why it matters

CVE-2026-115384 is a vulnerability in the Wasmtime component that can lead to a native stack buffer overflow due to an unvalidated async-lifted callback result count. Defenders should assess exposure, verify patch deployment, and prioritize remediation for affected systems.

• Potential native stack buffer overflow
• Exposure of Wasmtime deployments to potential exploitation
• Verification of patch deployment for vulnerable versions
• Prioritization of remediation for affected systems

Technical summary

The Wasmtime component has a vulnerability where an async-lifted callback result count is not validated, which can lead to a native stack buffer overflow. This issue affects Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1. The vulnerability is addressed in versions 48.0.4 and 49.0.2. Defenders should prioritize assessing exposure and verifying patch deployment for Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1, as remediation is available in versions 48.0.4 and 49.0.2. The vulnerability details are based on the RustSec database entry for Wasmtime security advisory GHSA-32h6-97mm-8q3c.

Defensive priority

Defenders should prioritize assessing exposure and verifying patch deployment for Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1, as remediation is available in versions 48.0.4 and 49.0.2.

Recommended defensive actions

• Assess exposure of Wasmtime deployments to this vulnerability
• Verify patch deployment for Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1
• Upgrade to Wasmtime version 48.0.4 or 49.0.2
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability details are based on the RustSec database entry for Wasmtime security advisory GHSA-32h6-97mm-8q3c. The advisory provides information on the vulnerability and its fix. The issue affects Wasmtime versions 39.0.0 through 48.0.3 and 49.0.0 through 49.0.1. The vulnerability is addressed in versions 48.0.4 and 49.0.2. Defenders should verify patch deployment for vulnerable versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.