RUSTSEC-2026-0326

Rooting for GC values live across try_call may be missing, causing GC heap corruption

Reported

October 2, 2026

Issued

October 2, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-hw8m-q44c-ggrf

References

https://github.com/bytecodealliance/wasmtime/pull/14478

CVSS Score

5.7 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Patched

>=48.0.4, <49.0.0
>=49.0.2

Unaffected

<47.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.