{"id":"CVE-2026-115384","published":"2026-10-22T19:17:45.543","lastModified":"2026-10-22T19:17:45.653","description":"Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c","tags":[]},{"url":"https://www.vulncheck.com/advisories/wasmtime-39.0.0-before-48.0.4-and-49.0.0-before-49.0.2-stack-buffer-overflow","tags":[]}],"exploitRefs":[{"url":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c","tags":[]}],"hasPoc":true,"ai":{"summary":"Wasmtime versions before 48.0.4 (39.x branch) and 49.0.2 (49.x branch) contain a stack buffer overflow in async callback handling, where unvalidated component-model-async callback result types allow malicious WebAssembly guests to write ~16KB onto the native stack, potentially overwriting return addresses and enabling sandbox escape or host crash.","exploitability":"Exploitation requires authenticated guest access to inject a malicious WebAssembly component with mistyped async callback functions; network exposure and low privilege are sufficient.","blast_radius":"Successful exploitation could allow an attacker to crash the Wasmtime host process or escape the sandbox to compromise the underlying host system, affecting confidentiality, integrity, and availability of the host.","remediation":"Upgrade to Wasmtime 48.0.4 or later for the 39.x branch, or 49.0.2 or later for the 49.x branch.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["stack-overflow","sandbox-escape","wasm","async-callback"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:51:28.681Z"}}