CVE-2026-115393 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments should assess exposure and consider upgrading to a fixed version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the affected versions of the Wasmtime package and assess exposure in their environments. Defenders should prioritize verifying the affected versions of the Wasmtime package and assessing exposure in their environments.

Why it matters

Defenders should prioritize verifying the affected versions of the Wasmtime package and assessing exposure in their environments.

• Verify affected versions of Wasmtime in your environment
• Assess exposure to the vulnerability
• Consider upgrading to a fixed version of Wasmtime

Technical summary

The Wasmtime package is vulnerable to a security issue where stores can mix up type indices between engines. This issue affects Wasmtime deployments, and defenders should assess exposure and consider upgrading to a fixed version. The vulnerability is related to the handling of type indices in Wasmtime, and defenders should prioritize verifying the affected versions of the Wasmtime package and assessing exposure in their environments. The evidence for this CVE comes from the RustSec database and the Wasmtime security advisory on GitHub.

Defensive priority

Defenders should prioritize verifying the affected versions of the Wasmtime package and assessing exposure in their environments.

Recommended defensive actions

• Verify the affected versions of the Wasmtime package in your environment
• Assess exposure to the vulnerability
• Consider upgrading to a fixed version of Wasmtime
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this CVE comes from the RustSec database and the Wasmtime security advisory on GitHub. The RustSec database provides a comprehensive record of security advisories for Rust packages, including Wasmtime. The Wasmtime security advisory on GitHub provides detailed information on the vulnerability, including affected versions and mitigation strategies. Defenders should verify the affected versions of the Wasmtime package and assess exposure in their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.