{"id":"EUVD-2026-113207","enisaUuid":"4ee65884-4295-3684-b753-7bac98fc7e39","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.","datePublished":"Oct 29, 2026, 3:58:19 PM","dateUpdated":"Oct 29, 2026, 3:58:19 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-thread-yield\n","aliases":"CVE-2026-119140\nGHSA-wf7v-f5qh-m5xv\n","assigner":"VulnCheck","epss":0.0,"enisaIdProduct":[{"id":"046821bc-608a-380e-b5b8-a27c4f356a1c","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"396463a5-7c8a-3f34-b388-0857ff32e147","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"enisaIdVendor":[{"id":"0647bc2e-bbfc-3bcf-ac51-a4e789614bd2","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"0238f95e-1e71-3bed-b2ec-d7e8512e6992","vulnerability":{"id":"GHSA-wf7v-f5qh-m5xv","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.","datePublished":"Oct 29, 2026, 6:31:01 PM","dateUpdated":"Oct 29, 2026, 6:31:01 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119140\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-thread-yield\n","enisa_id":"EUVD-2026-113207\n","aliases":"GHSA-wf7v-f5qh-m5xv\nCVE-2026-119140\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 5:00:57 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a9ce38c4-1191-34fe-ad80-ae403a142b68","vulnerability":{"id":"CVE-2026-119140","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.","datePublished":"Oct 29, 2026, 3:58:19 PM","dateUpdated":"Oct 29, 2026, 3:58:19 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-thread-yield\n","enisa_id":"EUVD-2026-113207\n","assigner":"VulnCheck","epss":0.0,"dataProcessed":"Oct 30, 2026, 5:00:41 AM","vulnerabilityProduct":[{"id":"ebb7911a-a08e-3083-b684-a81ad00b47c6","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"},{"id":"f2352605-5326-3536-b777-f0db75d275ec","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"vulnerabilityVendor":[{"id":"9b91b175-2e64-34fa-a434-7149d373e834","vendor":{"name":"bytecodealliance"}}]}}],"enisaIdAdvisory":[]}