AIKIDO-2026-741038

wasmtime is vulnerable to Out-of-bounds Write

CVE-2026-115393Published Aug 3, 2026

CVE Score

Low

Out-of-bounds Write

TL;DR

Several public Wasmtime APIs allowed placing an object from one Engine into a Store belonging to a different Engine. Lookups keyed on raw per-engine type indices then silently returned the wrong answer, so a trampoline compiled for one function signature could be used with a Wasm function of another signature. That can cause an out-of-bounds write on the trampoline stack when the host writes return values past the end of the allocation sized for the wrong signature, as well as type confusion or GC heap corruption on related APIs. The bug is not triggerable by guest WebAssembly; it requires an embedder that creates two Engines and mixes objects between them. The fix validates that every object handed to a Store comes from the same Engine.

How do I fix this?

Upgrade the wasmtime library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your embedding creates multiple Engines and mixes modules, components, types, or related objects across stores from different engines. Embeddings that use a single Engine for the process lifetime, and guest WebAssembly alone, are not affected.