Cloudanix VulnDB

CVE-2026-119136

Medium · 4.8

CVSS

4.8

EPSS

0.2%

Published

Oct 29, 2026

CISA due date

—

The record

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities