CVE-2026-119143 bytecodealliance CVE debrief

Who should care

Defenders responsible for systems or applications using Wasmtime, particularly in environments where untrusted WebAssembly (WASM) is executed, should assess exposure and verify patch deployment.

Why it matters

Defenders should care about CVE-2026-119143 as it details a specific issue with Wasmtime that can cause a panic due to out-of-bounds zero-length stream writes. This issue can potentially impact WASM execution environments and requires verification of patch deployment to prevent exposure.

• Potential denial of service (DoS) due to panic
• Need to verify patch deployment to prevent exposure
• Possible impact on WASM execution environments

Technical summary

The Wasmtime security advisory GHSA-93g3-36p8-x2gc details an issue where out-of-bounds zero-length stream writes can cause a panic. This issue is recorded in the RustSec database as RUSTSEC-2026-0357 and has been assigned CVE-2026-119143. Affected versions of Wasmtime include those between 46.0.0 and 48.0.6, and 49.0.0 and 49.0.3. A pull request addressing the issue is available. The issue can potentially impact WASM execution environments and requires verification of patch deployment to prevent exposure. Defenders should prioritize assessing exposure and verifying patch deployment for Wasmtime, particularly in environments where untrusted WebAssembly (WASM) is executed.

Defensive priority

Defenders should prioritize assessing exposure and verifying patch deployment for Wasmtime, particularly in environments where untrusted WebAssembly (WASM) is executed.

Recommended defensive actions

• Assess exposure of Wasmtime in environments where untrusted WASM is executed
• Verify patch deployment to ensure version 48.0.6 or 49.0.3 is used
• Monitor for potential WASM-related issues in Wasmtime
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The advisory details a specific issue with Wasmtime where out-of-bounds zero-length stream writes can cause a panic. This issue is noted in the RustSec database and a CVE entry was created. A pull request addressing the issue is referenced.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.