{"id":"EUVD-2026-113206","enisaUuid":"fd43be64-2671-3369-b5ba-1d08183aa180","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.","datePublished":"Oct 29, 2026, 3:58:19 PM","dateUpdated":"Nov 4, 2026, 1:29:04 AM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-func-call\n","aliases":"CVE-2026-119139\nGHSA-6862-c5q5-q6rc\n","assigner":"VulnCheck","epss":0.21,"enisaIdProduct":[{"id":"39816de5-2622-3b03-8dbc-4b72c78c6811","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"b13021f9-8ef2-3549-aaf7-89d03b391e2e","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"e0093dc4-4230-31d0-a400-09dbb691be35","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"0384b9b0-9429-3ea9-80a9-bac7b82867ce","vulnerability":{"id":"CVE-2026-119139","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.","datePublished":"Oct 29, 2026, 3:58:19 PM","dateUpdated":"Nov 4, 2026, 1:29:04 AM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-func-call\n","enisa_id":"EUVD-2026-113206\n","assigner":"VulnCheck","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"cf591cf6-a6ca-35a7-8b13-1e3d35cd8f0b","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"d0baab92-c880-3e9d-a45e-2c8f0f14b9db","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"413831d0-f624-39df-9ff6-81da86ed5281","vendor":{"name":"bytecodealliance"}}]}},{"id":"d53915fc-be13-3669-ad57-f80a4534b0c2","vulnerability":{"id":"GHSA-6862-c5q5-q6rc","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.","datePublished":"Oct 29, 2026, 6:31:01 PM","dateUpdated":"Oct 29, 2026, 6:31:01 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119139\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-func-call\n","enisa_id":"EUVD-2026-113206\n","aliases":"GHSA-6862-c5q5-q6rc\nCVE-2026-119139\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}