Panic on Erroneous Call-to-Host in Wasmtime Package - CVE-2026-0356
Summary
RUSTSEC-2026-0356: Panic on erroneous call-to-host from guest realloc call. Affects wasmtime across 2 version ranges.
>= 46.0.0, < 48.0.6
>= 49.0.0, < 49.0.3
Fixed in 48.0.6 or 49.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a standalone JIT-style runtime for WebAssembly, designed to execute WebAssembly modules efficiently and securely. It provides a safe environment for running untrusted code, making it a popular choice for developers looking to integrate WebAssembly into their applications. However, a recent vulnerability has been identified that could lead to a panic during erroneous calls from guest realloc functions, potentially affecting the stability of applications using this package.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of realloc calls made from guest code in the Wasmtime runtime. When a guest attempts to reallocate memory incorrectly, it can trigger a panic, leading to unexpected behavior or crashes in the host application. This issue is particularly concerning as it may allow attackers to exploit the panic to disrupt service or execute arbitrary code, depending on the context in which Wasmtime is used. The vulnerability affects versions 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3 of the Wasmtime package.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 46.0.0, < 48.0.648.0.6 -
>= 49.0.0, < 49.0.349.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to monitor the application for any erroneous realloc calls and ensure that the Wasmtime package is updated to a secure version as soon as possible.
Conclusion
In summary, the Wasmtime package has a vulnerability that can lead to a panic during erroneous realloc calls from guest code. It is crucial for developers using this package to update to the latest patched versions to mitigate potential risks. Regular monitoring and using tools like Vulert can help ensure that your applications remain secure.
See every vulnerability recorded for wasmtime →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
The affected versions are 46.0.0 to 48.0.6 and 49.0.0 to 49.0.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, ensure to monitor your application for any unusual behavior and plan to update the package as soon as possible.
More information can be found in the security advisory at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
