Is CVE-2026-115892 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115892 being exploited in the wild.

How severe is CVE-2026-115892?

Medium severity, with a CVSS score of 4, published 23 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime 46.0.0 to 48.0.6, 49.0.0 to 49.0.3; wasmtime (crates.io) >= 46.0.0, < 48.0.7, SEMVER:introduced=46.0.0,fixed=48.0.7.

Is there a fix for CVE-2026-115892?

Yes. wasmtime (crates.io): upgrade to 48.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-115892 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-115892?

Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115892: Wasmtime component-model type-check bypass in stream/future lowering

Q: Is there a fix for CVE-2026-115892?

Yes. wasmtime (crates.io): upgrade to 48.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-115892 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-115892?

Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115892 · Severity: medium · CVSS 4 · Published 2026-10-23

Wasmtime, a WebAssembly runtime, can be forced to crash when a malicious guest component passes a stream or future object through type-erased interfaces and then to functions expecting different payload types. Embedders using Wasmtime to run untrusted guest code are vulnerable to denial of service attacks, though only if they reuse streams or futures created on the host across multiple guests with differing type expectations.

Technologies: Bytecode Alliance Wasmtime, wasmtime (crates.io). Vendors: Bytecode Alliance, crates.io.

Quick answers

Is CVE-2026-115892 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115892 being exploited in the wild.
How severe is CVE-2026-115892?: Medium severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime 46.0.0 to 48.0.6, 49.0.0 to 49.0.3; wasmtime (crates.io) >= 46.0.0, < 48.0.7, SEMVER:introduced=46.0.0,fixed=48.0.7.
Is there a fix for CVE-2026-115892?: Yes. wasmtime (crates.io): upgrade to 48.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115892 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-115892?: Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 48.0.7 or later
```
cargo update -p wasmtime
```

Technical details

A type confusion vulnerability in Wasmtime's component model stream and future lowering logic allows a guest to trigger an uncaught panic in the host when a host-created stream or future is passed through the guest as a type-erased value (StreamAny, FutureAny, or Val::Stream/Val::Future) and then passed to a guest function whose payload type differs from the original. The vulnerability requires specific embedder usage patterns: host-created streams/futures must transit through guest code before being passed to functions with mismatched types. Fixes are available in versions 48.0.7 and 49.0.4.

Affected products

Bytecode Alliance Wasmtime 46.0.0 to 48.0.6, 49.0.0 to 49.0.3

Identifiers

CVE-2026-115892
GHSA-9pvw-hwfg-92h5
RUSTSEC-2026-0378

Timeline

2026-10-19: disclosed
2026-10-23: advisory
2026-10-23: patched

References

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.