takenaka hiroya@Joe_Biden_ja
Wasmtime にスタックオーバーフローの欠陥（CVSS 9.9）。WebAssembly を組み込んで信頼できないコードを動かしている環境は要確認です。対象バージョンと修正版を載せました。 https://cve.autoarticles.net/cve/CVE-2026-115384
0000022
557 followersView on X
CVE-2026-115384
LOWCVSS 9.4 · CRITICALImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-20
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE