CVE-2026-126409 json
Wasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype
published 15d ago modified 4h ago also EUVD-2026-125034 , GHSA-qw58-7h65-crq2 , RUSTSEC-2026-0423
- cvss
- 2.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.
Patch / fix
- crates.io wasmtime 48.0.8, 49.0.5, 50.0.1
- bytecodealliance wasmtime 48.0.8, 49.0.5, 50.0.1
- github.com/bytecodealliance/wasmtime#15078 pull request
Is CVE-2026-126409 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-13).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 1.8 | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 2.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 1.8 | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 2.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime | >=47.0.0, <48.0.8 >=49.0.0, <49.0.5 >=50.0.0, <50.0.1 |
48.0.8 49.0.5 50.0.1 |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-843 Access of Resource Using Incompatible Type
References
-
github.com
/bytecodealliance/wasmtime/pull/15078
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-qw58-7h65-crq2
vendor-advisory, advisory
-
vulncheck.com
/advisories/wasmtime-47.0.0-before-48.0.8-cross-engine-type-confusion-via-structtype-supertype
third-party-advisory
-
crates.io
/crates/wasmtime
package
-
rustsec.org
/advisories/RUSTSEC-2026-0423.html
advisory
Sources
- CVE List CVE-2026-126409
- NVD CVE-2026-126409
- OSV RUSTSEC-2026-0423
- Maintainer advisory GHSA-qw58-7h65-crq2
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of bytecodealliance/wasmtime published their own advisory on GitHub. Reviewed sources take precedence over it.