CVE-2026-119133 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments, especially those using exception tags, should assess the potential impact on their systems and verify the alignment of host data structures.

Why it matters

This vulnerability affects Wasmtime deployments using exception tags, potentially causing host data structures to be unaligned. Defenders should verify the alignment of host data structures and assess the potential impact on their systems.

• Verification of host data structure alignment is necessary to prevent potential system instability
• Defenders should assess the impact of exception tags on system stability in Wasmtime deployments

Technical summary

The vulnerability occurs when exception tags cause host data structures to be unaligned in Wasmtime. This issue affects Wasmtime versions between 47.0.0 and 48.0.6, and 49.0.0 and 49.0.3. The vulnerability affects Wasmtime deployments using exception tags, potentially causing host data structures to be unaligned. Defenders should verify the alignment of host data structures and assess the potential impact on their systems. The source corpus provides limited information about the vulnerability, primarily from the RustSec database and Wasmtime security advisory.

Defensive priority

Defenders should prioritize verifying the alignment of host data structures in Wasmtime deployments, especially those using exception tags, and assess the potential impact on their systems.

Recommended defensive actions

• Verify the alignment of host data structures in Wasmtime deployments
• Assess the potential impact of exception tags on system stability
• Monitor for updates from the Wasmtime project regarding this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides limited information about the vulnerability, primarily from the RustSec database and Wasmtime security advisory. The CVE record and NVD entry do not provide additional details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.