CVE-2026-115379CWE-416

CVE-2026-115379

Medium · published October 22, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-10-22T23:17Z
References (2)
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf · [email protected]https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-try-call · [email protected]
EPSS history
Timeline
  • 24 OCT 03:52Z
    EPSS moved — → 0%
    epss
  • 22 OCT 19:13Z
    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
    cvelistv5
  • 22 OCT 19:13Z
    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call
    cvelistv5