CVE-2026-119142

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::callasync can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting...

ReflectiveDLLInjection

About Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable PE fi...

CVE-2022-22965

CVE-2022-22965 Exploit Of Spring4Shell! Usages python3 exploit.py Target Host...

EUVD-2026-113210

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated...

CVE-2026-119142

The Wasmtime runtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 are vulnerable to a denial of service condition. The root cause is located in the TypedFunc::call_async function, where dropping the returned Future can cause a host panic. Specifically, if a guest task has not yet starte...

CVE-2026-119143

The Wasmtime runtime (versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3) is vulnerable to a denial of service issue. Guest code can trigger a host panic by performing out-of-bounds zero-length stream operations within the component model. Specifically, malicious guests can execute zero-lengt...

EUVD-2026-113209

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::callasync can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting...

CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::callasync can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting...

CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated...

CVE-2026-119142 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::callasync can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting...

CVE-2026-119141

The Wasmtime runtime is vulnerable to a denial of service (DoS) condition in versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 . The root cause is that the may_leave flag is not cleared during a realloc operation, which allows malicious Wasm modules to panic the host. Specifically, an attack...

CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119139

Wasmtime versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 are vulnerable to a host crash due to a leftover assertion in component::Func::call. This assertion incorrectly rejects guest exports that utilize the async ABI option. An attacker providing a component with an async-lifted export ca...

CVE-2026-119139 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119137

The Wasmtime runtime is vulnerable to a stack overflow in versions 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 . The root cause is uncontrolled recursion (CWE-674) occurring during recursive type drops. A guest can define a long chain of recursive types; removing the top-level type triggers unb...

CVE-2026-119137 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting th...

CVE-2026-119137 Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting th...

EUVD-2026-113203

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-119135

The Wasmtime runtime (versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3) is vulnerable to a panic during the host-to-host read path. The root cause is that the host asserts matching TypeIds instead of returning an error when reading a component model stream as a different Rust item type than...