Reliance on Data/Memory Layout in Wasmtime - #VU155842
Published: October 15, 2026
Vulnerability identifier: #VU155842
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-188
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause undefined behavior in the host.
The vulnerability exists due to improper alignment of host data structures in Wasmtime's VMContext layout logic when processing WebAssembly modules containing an odd number of exception tags. A remote user can supply such a module to cause undefined behavior in the host.
Only embedders with WebAssembly exceptions enabled are affected. No exploitable consequence was known at the time of publication.
Affected software
Wasmtime
Remediation
Install security update from vendor's website.
Wasmtime - addressed in versions 48.0.6, 49.0.3