Is CVE-2026-119143 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119143 being exploited in the wild.

How severe is CVE-2026-119143?

Medium severity, with a CVSS score of 4.8, published 29 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3.

Is there a fix for CVE-2026-119143?

Yes: fixed in Wasmtime 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119143 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119143?

Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119143: Wasmtime denial of service in component model stream operations

CVE-2026-119143 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Wasmtime is a WebAssembly runtime used to execute untrusted guest code in embedded systems and services. A vulnerability in its component model stream handling allows malicious guest code to crash the host system by triggering a panic through zero-length stream operations with out-of-bounds addresses. This denial of service affects any application that uses Wasmtime's WASIp3 implementation or the Direct stream APIs.

Technologies: Bytecode Alliance Wasmtime. Vendors: Bytecode Alliance.

Quick answers

Is CVE-2026-119143 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119143 being exploited in the wild.
How severe is CVE-2026-119143?: Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3.
Is there a fix for CVE-2026-119143?: Yes: fixed in Wasmtime 48.0.6, 49.0.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119143 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119143?: Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Wasmtime 48.0.6, 49.0.3

Technical details

The vulnerability exists in Wasmtime's DirectSource and DirectDestination APIs, specifically the remaining method, which fails to validate addresses during zero-length component model stream reads or writes. While the specification permits skipping address validation for zero-length operations, Wasmtime later indexes into guest linear memory without proper bounds checking, causing a panic. This affects all embedders using WASIp3 in the wasmtime-wasi crate or directly using the Direct stream APIs with untrusted guest code.

Affected products

Bytecode Alliance Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3

Timeline

2026-10-14: advisory
2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.