{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115393", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:27:18.001Z", "datePublished": "2026-10-22T19:13:59.314Z", "dateUpdated": "2026-10-22T19:13:59.314Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:59.314Z"}, "datePublic": "2026-07-31T00:00:00.000Z", "title": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion", "descriptions": [{"lang": "en", "value": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "bytecodealliance", "product": "wasmtime", "defaultStatus": "unaffected", "packageURL": "pkg:cargo/wasmtime", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "24.0.12"}, {"version": "24.0.12", "status": "unaffected", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "versionType": "semver", "lessThan": "36.0.13"}, {"version": "36.0.13", "status": "unaffected", "versionType": "semver"}, {"version": "37.0.0", "status": "affected", "versionType": "semver", "lessThan": "46.0.2"}, {"version": "46.0.2", "status": "unaffected", "versionType": "semver"}, {"version": "47.0.0", "status": "affected", "versionType": "semver", "lessThan": "47.0.3"}, {"version": "47.0.3", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*", "versionEndExcluding": "24.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.0.0", "versionEndExcluding": "36.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*", "versionStartIncluding": "37.0.0", "versionEndExcluding": "46.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*", "versionStartIncluding": "47.0.0", "versionEndExcluding": "47.0.3"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-hgjw-h833-99q9)"}, {"name": "VulnCheck Advisory: Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:cargo/wasmtime", "product": "wasmtime", "vendor": "bytecodealliance", "versions": [{"lessThan": "24.0.12", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "24.0.12", "versionType": "semver"}, {"lessThan": "36.0.13", "status": "affected", "version": "25.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "36.0.13", "versionType": "semver"}, {"lessThan": "46.0.2", "status": "affected", "version": "37.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "46.0.2", "versionType": "semver"}, {"lessThan": "47.0.3", "status": "affected", "version": "47.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "47.0.3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because several Store APIs fail to validate that objects belong to the Store's Engine. Embedders mixing objects between Engines via Instance::new, StructRefPre::new, or Tag::new can trigger trampoline signature mismatches causing out-of-bounds stack writes, GC heap corruption, or panics."}], "id": "CVE-2026-115393", "lastModified": "2026-10-22T19:17:47.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 3.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-22T19:17:47.033", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "wasmtime: wasmtime: Memory corruption via cross-engine object validation failure", "id": "2559290", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559290"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in Wasmtime. Several Store application programming interfaces (APIs) fail to verify that objects belong to the expected execution engine. If an embedding application mixes objects between different engines, this type confusion can lead to memory corruption, including out-of-bounds stack writes, or cause crashes resulting in a Denial of Service (DoS)."], "name": "CVE-2026-115393", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Fix deferred", "package_name": "rhcl-1/wasm-shim-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "tree-sitter", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "virt-firmware-rs", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-22T19:13:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115393\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115393\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hgjw-h833-99q9\nhttps://www.vulncheck.com/advisories/wasmtime-before-24.0.12-25.0.0-before-36.0.13-37.0.0-before-46.0.2-and-47.0.0-before-47.0.3-cross-engine-type-confusion"], "threat_severity": "Low"}