{"id":"EUVD-2026-113208","enisaUuid":"da7aabd5-6a29-370b-8819-ba500ffead74","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.","datePublished":"Oct 29, 2026, 3:58:20 PM","dateUpdated":"Oct 29, 2026, 5:14:25 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-realloc\n","aliases":"CVE-2026-119141\nGHSA-7w3v-6qhp-7c4h\n","assigner":"VulnCheck","epss":0.37,"enisaIdProduct":[{"id":"103896c6-4742-362f-9744-0b3625a29fc4","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"},{"id":"31fa8bf0-e4d4-3508-ac0c-b5cb3c660c02","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"}],"enisaIdVendor":[{"id":"d9409c07-1f94-3496-aa26-93bc830d3b84","vendor":{"name":"bytecodealliance"}}],"enisaIdVulnerability":[{"id":"ac0ff9dd-cc4b-3717-b839-24268aa83cf4","vulnerability":{"id":"CVE-2026-119141","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.","datePublished":"Oct 29, 2026, 3:58:20 PM","dateUpdated":"Oct 29, 2026, 5:14:25 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-realloc\n","enisa_id":"EUVD-2026-113208\n","assigner":"VulnCheck","epss":0.37,"dataProcessed":"Nov 2, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"4b9acc79-95ef-39f5-9a38-d9918343ff59","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"49.0.0 \u003c49.0.3"},{"id":"5fb1b6ca-2743-3df9-a22d-28d9d6874521","product":{"name":"wasmtime","vendor":{"name":"bytecodealliance"}},"product_version":"46.0.0 \u003c48.0.6"}],"vulnerabilityVendor":[{"id":"05ba549b-aeb0-3198-9dfc-acbb4293196f","vendor":{"name":"bytecodealliance"}}]}},{"id":"cca83e98-45cd-33ed-b490-444c63058055","vulnerability":{"id":"GHSA-7w3v-6qhp-7c4h","description":"Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.","datePublished":"Oct 29, 2026, 6:31:01 PM","dateUpdated":"Oct 29, 2026, 6:31:01 PM","baseScore":0.0,"references":"https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119141\nhttps://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-host-panic-via-realloc\n","enisa_id":"EUVD-2026-113208\n","aliases":"GHSA-7w3v-6qhp-7c4h\nCVE-2026-119141\n","epss":0.0,"dataProcessed":"Nov 2, 2026, 7:03:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}