{"id":"EUVD-2026-113199","enisaUuid":"5eaf71e3-c403-3c1c-b7e7-fa7d08da6663","description":"Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.","datePublished":"Oct 29, 2026, 3:58:13 PM","dateUpdated":"Nov 3, 2026, 3:55:15 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q\nhttps://www.vulncheck.com/advisories/wasmtime-49.0.0-before-49.0.3-host-panic-via-overlapping-string-transcode-in-fused-adapter\n","aliases":"CVE-2026-119132\nGHSA-hv43-9665-59p4\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"8885c087-9138-3765-9aad-328efaa90e69","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"enisaIdVendor":[{"id":"d7ece919-48b0-3cad-9cbc-de9be17f018f","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"6201599b-3988-3285-9d06-968f9e680603","vulnerability":{"id":"CVE-2026-119132","description":"Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.","datePublished":"Oct 29, 2026, 3:58:13 PM","dateUpdated":"Nov 3, 2026, 3:55:15 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q\nhttps://www.vulncheck.com/advisories/wasmtime-49.0.0-before-49.0.3-host-panic-via-overlapping-string-transcode-in-fused-adapter\n","enisa_id":"EUVD-2026-113199\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"40ed5b9f-a1f1-3f93-aa3d-0e5c2af551ee","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"vulnerabilityVendor":[{"id":"6e5a0cb1-21f6-3f61-9aee-98fc2c2054b8","vendor":{"name":"bytecodealliance"}}]}},{"id":"e91ffbe0-0fce-39d0-a653-6b38d2f60769","vulnerability":{"id":"GHSA-hv43-9665-59p4","description":"Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.","datePublished":"Oct 29, 2026, 6:30:59 PM","dateUpdated":"Oct 29, 2026, 6:30:59 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119132\nhttps://www.vulncheck.com/advisories/wasmtime-49.0.0-before-49.0.3-host-panic-via-overlapping-string-transcode-in-fused-adapter\n","enisa_id":"EUVD-2026-113199\n","aliases":"GHSA-hv43-9665-59p4\nCVE-2026-119132\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}