Is CVE-2026-119134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119134 being exploited in the wild.

How severe is CVE-2026-119134?

Medium severity, with a CVSS score of 6.2, published 29 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3.

How is CVE-2026-119134 attacked?

It is attacked with local access.

Am I affected by CVE-2026-119134?

Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119134: Wasmtime component-model resource handle unbounded memory growth

CVE-2026-119134 · Severity: medium · CVSS 6.2 · Published 2026-10-29

Wasmtime is a runtime for WebAssembly, a technology that allows untrusted code to execute in a sandboxed environment. A vulnerability in how Wasmtime manages memory allocation for component-model resource handles allows a malicious WebAssembly guest to consume unbounded amounts of host memory, causing a denial of service. This could crash applications relying on Wasmtime or make them unresponsive.

Technologies: Bytecode Alliance Wasmtime. Vendors: Bytecode Alliance.

Quick answers

Is CVE-2026-119134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119134 being exploited in the wild.
How severe is CVE-2026-119134?: Medium severity, with a CVSS score of 6.2, published 29 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3.
Is there a fix for CVE-2026-119134?: Yes: fixed in 36.0.18, 48.0.6, 49.0.3. Until then: Set a store-wide limit on component-model handles using the Store::set_max_component_handles(n) embedder API or the -S max-component-handles=N CLI flag to restrict memory growth; the default limit is 100,000 live handles per store (~2.4 MB). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119134 attacked?: It is attacked with local access.
Am I affected by CVE-2026-119134?: Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 36.0.18, 48.0.6, 49.0.3

Set a store-wide limit on component-model handles using the Store::set_max_component_handles(n) embedder API or the -S max-component-handles=N CLI flag to restrict memory growth; the default limit is 100,000 live handles per store (~2.4 MB).

Technical details

The vulnerability exists in Wasmtime's component-model implementation, where resource handle table allocations are capped only per component instance and are not charged to ResourceLimiter or StoreLimits. A malicious guest can call resource.new repeatedly and instantiate sub-components to bypass the per-instance cap, causing unbounded memory growth on the host. The attack requires local/guest code execution but no special privileges or user interaction.

Affected products

Bytecode Alliance Wasmtime before 36.0.18, 37.0.0 before 48.0.6, 49.0.0 before 49.0.3

Timeline

2026-10-14: disclosed
2026-10-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.