EUVD-2026-113202

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created...

CVE-2026-119135

The Wasmtime runtime (versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3) is vulnerable to a panic during the host-to-host read path. The root cause is that the host asserts matching TypeIds instead of returning an error when reading a component model stream as a different Rust item type than...