Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…smtime/security/advisories/GHSA-7v24-42x9-pxf7 Üretici bülteni
• vulncheck.com/…nd-49.0.0-before-49.0.3-host-panic-via-realloc Üçüncü taraf

Kayıt geçmişi

1. 29 Eki 2026 18:58Yayımlandı

İlgili açıklar

• 4,8 CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes
• 4,8 CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop
• 4,8 CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call
• 4,8 CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield
• 4,8 CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap
• 5,3 CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry