AIKIDO-2026-479662

TL;DR

Wasmtime's validation of WebAssembly components does not correctly check tag imports on an instantiated core module, so a component can import a tag whose type is a mismatched subtype of the module's declared tag, which the WebAssembly specification forbids. A guest can use that gap to mistype the payload of an exception object, and the garbage collector then processes that payload as the declared type, corrupting the GC heap. The bug only affects guests that use the WebAssembly exceptions proposal, which is on by default, and a corrupted GC heap can cause the host to panic during unrelated operations. The fix rejects components whose tag imports use an incompatible subtype during validation.