Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 14 October 2026.

Which products and versions are affected?

Bytecode Alliance Wasmtime 46.0.0–48.0.5, 49.0.0–49.0.2; wasmtime (crates.io) SEMVER:introduced=46.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.

Is there a fix for This vulnerability?

Yes. wasmtime (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Wasmtime panic when invoking async-lifted function via call

Severity: medium · CVSS 4 · Published 2026-10-14

Wasmtime is a WebAssembly runtime that executes compiled code from untrusted sources. An attacker with low privileges can crash the Wasmtime process by invoking an async-lifted function through the `call` mechanism, causing a denial of service and interrupting any applications or services relying on the runtime.

Technologies: Bytecode Alliance Wasmtime, wasmtime (crates.io). Vendors: Bytecode Alliance, crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 14 October 2026.
Which products and versions are affected?: Bytecode Alliance Wasmtime 46.0.0–48.0.5, 49.0.0–49.0.2; wasmtime (crates.io) SEMVER:introduced=46.0.0,fixed=48.0.6,introduced=49.0.0,fixed=49.0.3.
Is there a fix for This vulnerability?: Yes. wasmtime (crates.io): upgrade to 49.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Bytecode Alliance Wasmtime or wasmtime (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wasmtime (crates.io): upgrade to 49.0.3 or later
```
cargo update -p wasmtime
```

Technical details

An unhandled panic occurs in Wasmtime when an async-lifted function is invoked via the `call` operation. The vulnerability requires low privileges and user interaction but affects availability of the vulnerable system through a process crash. The issue is triggered through network-accessible Wasmtime instances with specific async function lifting configurations.

Affected products

Bytecode Alliance Wasmtime 46.0.0–48.0.5, 49.0.0–49.0.2

Identifiers

GHSA-m6w2-jwq2-cv2c
RUSTSEC-2026-0353

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.