CVE-2026-115379
MEDIUM
NVD
CVSS Score
5.7
Severity
MEDIUM
Published
Oct 22, 2026
Vendor
unknown
Description
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.