CVE-2026-115892: 
Rust vulnerability analysis and mitigation

CVE-2026-115892 is a type confusion vulnerability in Bytecode Alliance's Wasmtime WebAssembly runtime that allows a malicious guest to cause a denial-of-service by panicking the host process. The flaw affects Wasmtime versions 46.0.0 through 48.0.6 and 49.0.0 through 49.0.3, and was disclosed on October 23, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.7 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a missing payload-type check (CWE-843: Type Confusion; CWE-248: Uncaught Exception) when the Wasmtime host lowers a component-model stream or future into a guest after the value has passed through type-erasing interfaces such as StreamAny, FutureAny, Val::Stream, or Val::Future. When a host creates a stream or future with one payload type via StreamReader::new or FutureReader::new, passes it to a guest, receives it back under a type-erased form, and then passes it to a guest function expecting a different payload type, the required type check is omitted. A malicious guest controlling exported function types or returned values can deliberately trigger this mismatch, causing an unhandled panic in the Wasmtime host process. The fix centralizes type-checks unconditionally when lowering any future or stream into a guest, closing a gap left by the related prior fix in PR #14733 (GitHub Advisory, Fix PR #14827).

Successful exploitation results in an unhandled panic that terminates the Wasmtime host process, causing a denial of service. There is no impact on confidentiality or integrity — the vulnerability is limited to availability of the host application. Embedders that create streams or futures on the host and pass them through guest code before receiving them back under type-erased types are at risk; those using only statically typed StreamReader/FutureReader throughout, or that never pass host-created streams through a guest and back, are not affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Red Hat CVE). The EPSS score is 0.0, reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to control a malicious WebAssembly guest with execution privileges in a Wasmtime embedder that uses the specific host-guest stream/future passing pattern described above, making opportunistic exploitation unlikely.

1. Identify a vulnerable embedder: Target an application using Wasmtime versions 46.0.0–48.0.6 or 49.0.0–49.0.3 that creates component-model streams or futures on the host and passes them through guest code.
2. Craft a malicious WebAssembly component: Author a guest module that exports functions whose type signatures declare a stream or future payload type different from what the host originally created.
3. Trigger the type-erasing path: Cause the host to pass a host-created stream or future to the guest, which returns it under a type-erased form (StreamAny, FutureAny, Val::Stream, or Val::Future).
4. Induce the type mismatch: Have the guest return or expose the type-erased value in a context where the host will pass it to a guest function expecting a different payload type, bypassing the missing type check.
5. Achieve denial of service: The Wasmtime host encounters the type mismatch without a guard, triggering an unhandled Rust panic that terminates the host process (GitHub Advisory, Fix PR #14827).

• Logs: Unexpected Rust panic messages in application logs referencing Wasmtime component-model stream or future lowering code paths (e.g., panicked at messages in wasmtime crate stack traces involving future_stream_any.rs or futures_and_streams.rs).
• Process: Sudden, unexplained termination of the Wasmtime host process without a graceful shutdown signal.
• Application Behavior: Repeated crashes of services embedding Wasmtime when processing WebAssembly components that use asynchronous streams or futures, particularly when untrusted guest modules are loaded.

Bytecode Alliance has released patched versions 48.0.7 and 49.0.4, which unconditionally perform type-checks when lowering futures or streams into a guest, closing the vulnerability. Users should upgrade to one of these versions immediately. As a workaround prior to patching, restrict execution to trusted WebAssembly guests only, and avoid embedder patterns that create streams or futures on the host, pass them through guest code, and then pass the returned type-erased values to guest functions with different payload types (GitHub Advisory, Security Fixes PR 48.0.7, Security Fixes PR 49.0.4).

The advisory was published by Bytecode Alliance maintainer pchickey on October 19, 2026, alongside several other security fixes bundled in the 48.0.7 and 49.0.4 releases. The fix was noted as a partial follow-up to a related prior advisory (GHSA-63h4-6cx9-pjfj), with maintainers acknowledging that PR #14733 was not a complete fix for this class of issues. A corresponding RUSTSEC advisory (RUSTSEC-2026-0378) was submitted to the Rust advisory database, prompting automated dependency alerts across multiple downstream projects (Fix PR #14827).