CVE-2026-104855: Wasmtime Vulnerability in Bulk Operations Leading to Internal VM State Exposure
Summary
CVE-2026-104855: Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 46.0.2
>= 47.0.0, < 47.0.3
Fixed in 46.0.2 or 47.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a popular runtime for executing WebAssembly (Wasm) applications. It provides a safe and efficient environment for running Wasm code, enabling developers to build high-performance applications. However, it has been found to have vulnerabilities related to bulk-data-transfer operations, which can lead to unintended exposure of internal VM states.
Vulnerability Detail
The vulnerability arises from Wasmtime's handling of bulk-data-transfer WebAssembly instructions, such as memory.copy, in conjunction with preemption mechanisms. When a computation is preempted, the internal state of the VM can be altered, leading to scenarios where the state becomes inconsistent. For instance, if a WebAssembly table is grown and the operation is cancelled, it may leave the table in an uninitialized state, potentially causing segfaults during subsequent operations. This issue can be exploited by embedders who manipulate the store's state during preemption points, leading to further instability and corruption of the VM's internal state.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 46.0.246.0.2 -
>= 47.0.0, < 47.0.347.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are using Store::epoch_deadline_callback, ensure that you only access the T in Store<T>. Avoid continuing to use the store after a timeout or epoch deadline. However, if you need to mutate the store in an epoch callback or resume Wasm after trapping, there are no workarounds available, and you should update your embedding to address the vulnerability.
Conclusion
The Wasmtime vulnerability (CVE-2026-104855) poses risks related to the exposure of internal VM states during bulk operations. It is crucial for developers using Wasmtime to update to the patched versions to mitigate these risks and ensure the stability and security of their applications.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score of this vulnerability is 2.0, indicating a low severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Failing to address this vulnerability may lead to application crashes, data corruption, or unintended exposure of sensitive internal states.
Yes, the vulnerability can be triggered by embedder-driven mutations of the Store or by resuming a Store after a computation has been cancelled.
If updating is not possible, ensure that you do not mutate the store during epoch callbacks and avoid resuming Wasm operations after a timeout.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
