CVE-2026-126408 Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic

Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option, and Option parameter or result types, reaching an unreachable! path. A malicious guest module exporting a function that uses another...

CVE-2026-126408

The Wasmtime runtime versions 47.0.0 before 48.0.8 , 49.0.0 before 49.0.5 , and 50.0.0 before 50.0.1 are vulnerable to a Denial of Service (DoS) condition. The root cause is an insufficient type-check within the TypedFunc embedder API for specific parameter or result types, including I31 , Option...

EUVD-2026-125035

Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option, and Option parameter or result types, reaching an unreachable! path. A malicious guest module exporting a function that uses another...