{"id":"EUVD-2026-113203","enisaUuid":"24f29017-26f2-39a3-b31b-b0a3c37bfeff","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.","datePublished":"Oct 29, 2026, 3:58:16 PM","dateUpdated":"Nov 3, 2026, 3:59:56 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-async-entrypoint-enforcement-bypass\n","aliases":"CVE-2026-119136\nGHSA-xp2q-mv29-hr2p\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"5121c4f9-0468-3438-bb2a-4dae40a9c545","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"42.0.0 \u003c48.0.6"},{"id":"8783058e-c6ef-328a-b022-12b6bf91dddb","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"enisaIdVendor":[{"id":"bb0ed556-cc58-3256-bb02-fa7408a8a3bc","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"a4873e6b-5df3-3eb6-a8de-617099b073b4","vulnerability":{"id":"CVE-2026-119136","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.","datePublished":"Oct 29, 2026, 3:58:16 PM","dateUpdated":"Nov 3, 2026, 3:59:56 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-async-entrypoint-enforcement-bypass\n","enisa_id":"EUVD-2026-113203\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"02f0d113-1e2b-3e43-813e-3170140c9f17","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"42.0.0 \u003c48.0.6"},{"id":"65506b01-e1de-3359-b5db-4c3788a7ab46","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"vulnerabilityVendor":[{"id":"f916aa92-0f94-3803-a201-2353933388f2","vendor":{"name":"bytecodealliance"}}]}},{"id":"c6490f32-9125-3a4c-be1e-700a687e8961","vulnerability":{"id":"GHSA-xp2q-mv29-hr2p","description":"Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.","datePublished":"Oct 29, 2026, 6:31:00 PM","dateUpdated":"Oct 29, 2026, 6:31:00 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119136\nhttps://www.vulncheck.com/advisories/wasmtime-42.0.0-before-48.0.6-and-49.0.0-before-49.0.3-async-entrypoint-enforcement-bypass\n","enisa_id":"EUVD-2026-113203\n","aliases":"CVE-2026-119136\nGHSA-xp2q-mv29-hr2p\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}