RUSTSEC-2026-0327

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Reported

October 2, 2026

Issued

October 2, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-32h6-97mm-8q3c

References

https://github.com/bytecodealliance/wasmtime/pull/14471

CVSS Score

9.3 CRITICAL

CVSS Details

Attack Complexity: Low
Attack Requirements: None
Attack Vector: Network
Privileges Required: None
Availability Impact to the Subsequent System: High
Confidentiality Impact to the Subsequent System: Low
Integrity Impact to the Subsequent System: High
User Interaction: None
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: Low
Integrity Impact to the Vulnerable System: High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Patched

>=48.0.4, <49.0.0
>=49.0.2

Unaffected

<39.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.