Is CVE-2026-119135 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119135 being exploited in the wild.

How severe is CVE-2026-119135?

Medium severity, with a CVSS score of 4.8, published 29 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime 46.0.0 before 48.0.6, 49.0.0 before 49.0.3.

Is there a fix for CVE-2026-119135?

Yes: fixed in 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119135 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119135?

Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119135: Wasmtime panic in component model stream type mismatch

CVE-2026-119135 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Wasmtime is a WebAssembly runtime that executes untrusted code within applications. When host code reads a component model stream with a different Rust type than it was originally created with, Wasmtime panics and crashes the embedding process. This allows guest WebAssembly code to cause a denial of service by returning streams that the host reads as the wrong type.

Technologies: Bytecode Alliance Wasmtime. Vendors: Bytecode Alliance.

Quick answers

Is CVE-2026-119135 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119135 being exploited in the wild.
How severe is CVE-2026-119135?: Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime 46.0.0 before 48.0.6, 49.0.0 before 49.0.3.
Is there a fix for CVE-2026-119135?: Yes: fixed in 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119135 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119135?: Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 48.0.6, 49.0.3

Technical details

The vulnerability occurs in Wasmtime's component model stream handling when a StreamReader is created as one type (T) and later read as a different type (U) that maps to the same component model type. The host-to-host read path asserts matching Rust TypeIds instead of returning an error, causing a panic. An attacker controlling guest code can trigger this by returning a stream with a type mismatch, crashing the host process.

Affected products

Bytecode Alliance Wasmtime 46.0.0 before 48.0.6, 49.0.0 before 49.0.3

Timeline

2026-10-29: advisory
2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.