CVE-2026-115383CWE-1287

CVE-2026-115383

Medium · published October 22, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
5.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-1287 · Improper Validation of Specified Type of Input
Published
2026-10-22T23:17Z
References (2)
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj · [email protected]https://www.vulncheck.com/advisories/wasmtime-47.0.0-before-48.0.4-and-49.0.0-before-49.0.2-gc-heap-corruption-via-tag-imports · [email protected]
EPSS history
Timeline
  • 24 OCT 03:52Z
    EPSS moved — → 0%
    epss
  • 22 OCT 19:13Z
    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
    cvelistv5
  • 22 OCT 19:13Z
    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports
    cvelistv5