Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

Wasmtime may crash or corrupt memory during bulk operations

CVE-2026-104855 · published 16 days ago
Summary

Versions of the Wasmtime WebAssembly runtime (up to 46.0.2 and 47.0.3) can encounter crashes, invalid memory access, or data corruption when certain large operations are interrupted or trigger callbacks. This happens if the runtime’s internal checks are triggered while the application modifies or discards the execution context. Upgrade to the latest Wasmtime release to resolve the issue.

What to do
  • Update wasmtime-publish wasmtime to version 46.0.2.
  • Update wasmtime-publish wasmtime to version 47.0.3.
  • Update wasmtime to version 46.0.2.
  • Update wasmtime to version 47.0.3.
Affected software
Ecosystem VendorProductAffected versions
– bytecodealliance wasmtime >= 46.0.0, < 46.0.2
crates.io wasmtime-publish wasmtime >= 46.0.0, < 46.0.2
>= 47.0.0, < 47.0.3
Fix: upgrade to 46.0.2
crates.io – wasmtime >= 46.0.0, < 46.0.2
>= 47.0.0, < 47.0.3
Fix: upgrade to 46.0.2
Original advisory text
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store<T>, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Sources
CVE-2026-104855 · NVD
CVE-2026-104855 · MITRE
GHSA-2hw9-mc66-jc2q · OSV
Track software like this
Free during beta