Buffer Overflow Vulnerability in Wasmtime Package: Async-Lifted Callback Result Count Unvalidated
Summary
RUSTSEC-2026-0327: This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted secur... Affects wasmtime across 2 version ranges.
>= 39.0.0, < 48.0.4
>= 49.0.0, < 49.0.2
Fixed in 48.0.4 or 49.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime is a runtime for WebAssembly, enabling developers to run WebAssembly modules in various environments. It provides a high-performance execution environment and supports features like asynchronous operations and integration with Rust. However, it has been found to have a vulnerability that can lead to a native stack buffer overflow, posing significant security risks.
Vulnerability Detail
The vulnerability arises from the lack of validation on the count of results returned by async-lifted callbacks in the Wasmtime component. This oversight can lead to a buffer overflow, allowing attackers to exploit the native stack, potentially leading to arbitrary code execution or crashes. The vulnerability affects versions 39.0.0 to 48.0.4 and 49.0.0 to 49.0.2 of the Wasmtime package, with a CVSS score of 9.3 indicating a critical severity level.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 39.0.0, < 48.0.448.0.4 -
>= 49.0.0, < 49.0.249.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The Wasmtime package has a critical vulnerability related to unvalidated async-lifted callback result counts, leading to potential buffer overflow issues. Users are strongly advised to update to the latest patched versions to mitigate risks.
See every vulnerability recorded for wasmtime →
FAQ
The vulnerability is a buffer overflow caused by unvalidated result counts in async-lifted callbacks.
Versions 39.0.0 to 48.0.4 and 49.0.0 to 49.0.2 are affected by this vulnerability.
Exploitation of this vulnerability can lead to arbitrary code execution or crashes, compromising system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 9.3, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime.
