CVE-2026-115384

Summary

Wasmtime versions before 48.0.4 (39.x branch) and 49.0.2 (49.x branch) contain a stack buffer overflow in async callback handling, where unvalidated component-model-async callback result types allow malicious WebAssembly guests to write ~16KB onto the native stack, potentially overwriting return addresses and enabling sandbox escape or host crash.

Exploitability

Exploitation requires authenticated guest access to inject a malicious WebAssembly component with mistyped async callback functions; network exposure and low privilege are sufficient.

Blast radius

Successful exploitation could allow an attacker to crash the Wasmtime host process or escape the sandbox to compromise the underlying host system, affecting confidentiality, integrity, and availability of the host.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Wasmtime 48.0.4 or later for the 39.x branch, or 49.0.2 or later for the 49.x branch.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.