EUVD-2026-113208

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119141

The Wasmtime runtime is vulnerable to a denial of service (DoS) condition in versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 . The root cause is that the may_leave flag is not cleared during a realloc operation, which allows malicious Wasm modules to panic the host. Specifically, an attack...

CVE-2026-119141 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...