CVE-2026-115379 — Vulnerability intelligence

—

Published: 2026-10-22T19:17:44.747

CVSS

6.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

Sources

• CVE-2026-115379
• Original advisory
• Original advisory