Wasmtime Sandbox Escape Flaw Allows Remote Code Execution in Versions Before 49.0.2

The Bytecode Alliance maintains Wasmtime, a WebAssembly runtime that contains a critical security vulnerability. A newly disclosed stack buffer overflow, tracked as CVE-2026-115384, affects multiple versions of the software. This flaw impacts Wasmtime versions starting from 39.0.0 up to, but not including, 48.0.4 and 49.0.2.

The vulnerability carries a CVSS score of 9.4, classifying it as critical according to the National Vulnerability Database. It stems from insufficient validation of asynchronous callback result types within the component model. Malicious guests can exploit this by supplying components with mistyped component-model-async callback functions. This manipulation allows attackers to write roughly 16 kilobytes of data directly to the native stack.

Technical Context and Impact

The core issue involves a stack buffer overflow that bypasses standard safety mechanisms. By overwriting return addresses on the stack, attackers can disrupt the normal execution flow of the host application. This technique can lead to immediate crashes, denying service to legitimate users. More severely, it enables attackers to escape the Wasmtime sandbox entirely.

Escaping the sandbox is particularly dangerous because it grants the attacker access to the host system resources. The flaw is categorized under CWE-20, which denotes improper input validation. This weakness allows untrusted code to influence the runtime environment beyond its intended boundaries. The ability to write to the native stack provides a direct path for crashing the host or escaping the sandbox.

Affected Versions and Scope

The vulnerability impacts a wide range of Wasmtime releases. Specifically, all versions from 39.0.0 through 48.0.3 are affected. Additionally, the initial release of the 49.0.0 branch, versions 49.0.0 and 49.0.1, also contain this flaw. Users running any of these versions are exposed to potential exploitation.

This incident follows other significant runtime vulnerabilities reported recently. As Threat Times reported on October 22, 2026, Google Brotli versions 1.0.3 through 1.2.0 contained a critical buffer overflow allowing remote code execution via crafted compressed streams. Similarly, on October 21, 2026, Threat Times noted a critical remote code execution flaw in Tenda BE3L Pro firmware via a buffer overflow in the WifiBasicSet function.

What should you do?

Organizations using Wasmtime must verify their current version against the affected list. If running a vulnerable version, prioritize upgrading to 48.0.4 or 49.0.2 immediately. Monitor system logs for unexpected crashes or unusual stack behavior. Restrict the execution of untrusted WebAssembly components until patches are applied.