GHSA-xp2q-mv29-hr2pMediumCVSS 4.8
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when...
🔗 CVE IDs covered (1)
📋 Description
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.
🔗 References (4)
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379
- https://nvd.nist.gov/vuln/detail/CVE-2026-119136
- https://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-async-entrypoint-enforcement-bypass
- https://github.com/advisories/GHSA-xp2q-mv29-hr2p