Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-119135 · Microsoft / collected KEV context

EUVD-2026-113202

GHSA-68fq-q9rp-8gvr

RUSTSEC-2026-0355

GHSA-63h4-6cx9-pjfj

cve-program · CVE-2026-119135

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-streamreader-type-mismatch

euvd · EUVD-2026-113202

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-streamreader-type-mismatch

nvd · CVE-2026-119135

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj
• https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.6-and-49.0.0-before-49.0.3-panic-via-streamreader-type-mismatch

osv · RUSTSEC-2026-0355

• https://crates.io/crates/wasmtime
• https://rustsec.org/advisories/RUSTSEC-2026-0355.html
• https://github.com/bytecodealliance/wasmtime/pull/14733

• Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of return… · Advisory content revised · 5 Nov 2026
• Panic viewing component model stream or future as the wrong type · Advisory content revised · 30 Oct 2026
• Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch · Newly collected advisory · 29 Oct 2026