Wasmtime Sandbox Escape Lets Guests Overwrite Host Stack in Versions Before 49.0.2

Malicious WebAssembly guests running on Wasmtime can now compromise the host system by exploiting a stack buffer overflow in specific older versions. According to National Vulnerability Database records, attackers can supply components with mistyped component-model-async callback functions. This action allows them to overwrite return addresses on the native stack. The result is either a crash of the host application or a full escape from the sandbox environment.

In plain English

Wasmtime is a runtime for WebAssembly that isolates code in a sandbox. This flaw breaks that isolation. An attacker does not need to break into the host first; they only need to run malicious code inside the Wasmtime guest. By manipulating how asynchronous callbacks handle results, the guest writes too much data to the host's memory stack. This overflows the buffer and corrupts control flow, giving the attacker control over the host process.

The background

The National Vulnerability Database assigned CVE-2026-115384 to this issue. The record rates the severity as critical with a CVSS score of 9.4. The weakness is classified under CWE-20, which covers improper input validation. Affected software includes Wasmtime version 39.0.0 up to, but not including, 48.0.4. It also affects version 49.0.0 up to, but not including, 49.0.2. Bytecode Alliance maintains the Wasmtime project.

What changes now

Organizations using Wasmtime must verify their current version against the affected ranges. Those running versions prior to 48.0.4 or prior to 49.0.2 are exposed to this risk. The NVD record indicates that malicious guests can write approximately 16KB to the native stack. This capability is sufficient to overwrite return addresses. Until users update to the patched versions, the sandbox boundary is effectively permeable to this specific attack vector.

What made it possible

Teams usually rely on sandboxes to contain untrusted code, but input validation failures can breach these boundaries. This incident illustrates how improper handling of asynchronous data types can lead to memory corruption. Security operations should assess whether their Wasmtime instances process untrusted async callbacks. Check if input validation rigorously checks result types before processing. Understanding that type mismatches can trigger stack overflows helps prioritize monitoring for anomalous guest behavior that suggests exploitation attempts.

What to do and how to stay safe: Wasmtime

• Inventory all servers and containers running Wasmtime to identify those using versions before 48.0.4 or before 49.0.2.
• Monitor host processes for unexpected crashes or memory access violations that could indicate stack overflow exploitation.
• Restrict Wasmtime guests from executing untrusted or third-party code until a patched version is deployed.
• Review network logs for unusual outbound traffic from Wasmtime hosts, which may signal a successful sandbox escape.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Wasmtime versions are vulnerable to CVE-2026-115384?

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 are affected.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates the severity as critical with a CVSS score of 9.4.

Can this flaw be exploited remotely?

Yes, malicious guests can exploit this via unvalidated async callback result types to escape the sandbox.