Is CVE-2026-119139 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119139 being exploited in the wild.

How severe is CVE-2026-119139?

Medium severity, with a CVSS score of 4.8, published 29 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime 46.0.0 to 48.0.5, 49.0.0 to 49.0.2.

Is there a fix for CVE-2026-119139?

Yes: fixed in 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119139 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119139?

Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119139: Wasmtime host crash in async-lifted function invocation

CVE-2026-119139 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Wasmtime is a WebAssembly runtime that executes compiled code sandboxed within applications. An attacker who supplies a malicious WebAssembly component can crash the host application when it attempts to call certain functions, disrupting service availability. This occurs through a leftover assertion in the component model that was not properly removed during earlier refactoring.

Technologies: Bytecode Alliance Wasmtime. Vendors: Bytecode Alliance.

Quick answers

Is CVE-2026-119139 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119139 being exploited in the wild.
How severe is CVE-2026-119139?: Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime 46.0.0 to 48.0.5, 49.0.0 to 49.0.2.
Is there a fix for CVE-2026-119139?: Yes: fixed in 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119139 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119139?: Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 48.0.6, 49.0.3

Technical details

Wasmtime versions 46.0.0–48.0.5 and 49.0.0–49.0.2 contain an assertion in component::Func::call that incorrectly validates async-lifted guest exports, triggering a panic. The vulnerable code rejects async ABI–lifted exports even though async support is now always available; the check was left behind from an older conditional async_support configuration. An embedder invoking Func::call on an attacker-controlled component with an async-lifted export causes an unrecoverable host panic.

Affected products

Bytecode Alliance Wasmtime 46.0.0 to 48.0.5, 49.0.0 to 49.0.2

Timeline

2026-10-14: advisory
2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.