CVE-2026-119136
MEDIUM
NVD
CVSS Score
4.8
Severity
MEDIUM
Published
Oct 29, 2026
Vendor
unknown
Description
Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.