RUSTSEC-2026-0327 — Vulnerability in wasmtime — Advisory Details

CRITICAL

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Published October 2, 2026Updated October 2, 2026Source: osv

Summary

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory.

Advisory Timeline

First published October 2, 2026 (10 days ago).
Last revised October 2, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update wasmtime to 48.0.4 or later

cargo update -p wasmtime --precise 48.0.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
wasmtime	crates.io	All versions	48.0.4, 49.0.2

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

References

Frequently Asked Questions

What is RUSTSEC-2026-0327?: Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 10.0/10).
How do I check if my project is affected by RUSTSEC-2026-0327?: RUSTSEC-2026-0327 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against RUSTSEC-2026-0327 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

10.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-32h6-97mm-8q3c

Related CVEs

CVE-2023-26489
CRITICAL
Guest-controlled out-of-bounds read/write on x86\_64
CVE-2026-34987
CRITICAL
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
CVE-2022-39392
HIGH
Bug in Wasmtime implementation of pooling instance allocator
CVE-2022-39393
HIGH
Data leakage between instances in the pooling allocator
CVE-2022-39393
HIGH
Wasmtime may have data leakage between instances in the pooling allocator
CVE-2024-47763
MEDIUM
wasmtime has a runtime crash when combining tail calls with trapping imports
CVE-2026-34944
MEDIUM
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
CVE-2026-27195
MEDIUM
Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies