Wasmtime CVE-2026-115384

Requires (1) the embedder to have the component-model-async feature enabled - disabling it causes Wasmtime to reject any component using async features and fully avoids the issue; (2) an affected build (Wasmtime 39.0.0 through 48.0.3, or 49.0.0 through 49.0.1) using the vulnerable wasmparser v0.259.0 or earlier for validation; and (3) the attacker's ability to supply a guest component with a mistyped component-model-async callback result type to the runtime. Exploitation is limited to deployments that accept and run attacker-influenced components; trusted-only component pipelines, builds with component-model-async disabled, or validation via patched wasmparser v1.260.0+ are not exploitable. The only complete fix per the vendor is updating to 48.0.4 or 49.0.2.

This is a genuine high-priority issue, not an inflated CVSS score. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) rates it 9.4 with full compromise of both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), reflecting a sandbox escape where a malicious guest can overwrite native-stack return addresses to pass control to arbitrary host code or crash the process - the GHSA advisory explicitly recommends treating it as arbitrary-code-execution sandbox escape. The vuln.today priority is act_now, consistent with the total technical impact and low attack complexity. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the input, so exploitation status is: no public exploit identified at time of analysis; the act_now urgency is driven by impact and exploitability of the flaw, not by evidence of in-the-wild activity. The key mitigating factors are configuration-dependent rather than attacker-side: exploitation requires the embedder to have the component-model-async feature enabled and to accept a guest-supplied component, and the advisory notes OS defenses (ASLR, non-executable stack) can thwart simple arbitrary-code-execution attempts though they do not make the host safe. One nuance to verify locally: the official vector uses AV:N/PR:L, but whether the attack is truly remote and what 'privilege' means depends entirely on the embedding - in deployments that accept untrusted components over a network with no authentication this behaves closer to unauthenticated remote, whereas in trusted-only embeddings the exposure is much lower.

An embedder runs Wasmtime (39.0.0-48.0.3 or 49.0.0-49.0.1) with the component-model-async feature enabled and executes a guest component supplied by a lower-trust or external party. The attacker crafts a component whose component-model-async callback function has a mistyped signature that wasmparser (v0.259.0 or earlier) fails to reject, and when the runtime invokes the callback it writes up to ~16KB of attacker-chosen data onto the native stack, overwriting return addresses to crash the host or escape the sandbox. No public exploit identified at time of analysis, so weaponization effort is unverified.