CVE-2026-115892

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

This affects embedders that do all of the following:

1. Create streams or futures on the host with StreamReader::new or FutureReader::new
2. Pass them to guest code and receive them back as StreamAny, FutureAny, Val::Stream/Val::Future, or a typed reader whose payload is one of these.
3. Pass them on to a guest function whose stream or future payload type differs from the type the host created them with.

A guest can cause the mismatch in step 3 when it controls the types of the functions it exports or of the values it returns. In that case a malicious guest can make the host panic, a denial of service. Embedders that only use statically typed StreamReader<T>/FutureReader<T> with concrete payload types throughout, or that never pass streams or futures they created through a guest and back, are not affected.

An object is accessed using a type that is incompatible with its actual type, causing the runtime to interpret memory incorrectly. Typical impact: memory safety violations, unexpected behavior, or code execution.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-115892? CVE-2026-115892 is a medium-severity type confusion vulnerability in wasmtime (rust), affecting versions >= 46.0.0, < 48.0.7. It is fixed in 48.0.7, 49.0.4. An object is accessed using a type that is incompatible with its actual type, causing the runtime to interpret memory incorrectly.
2. Which versions of wasmtime are affected by CVE-2026-115892? wasmtime (rust) versions >= 46.0.0, < 48.0.7 is affected.
3. Is there a fix for CVE-2026-115892? Yes. CVE-2026-115892 is fixed in 48.0.7, 49.0.4. Upgrade to this version or later.
4. Is CVE-2026-115892 exploitable, and should I be worried? Whether CVE-2026-115892 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-115892 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-115892?
   • Upgrade wasmtime to 48.0.7 or later
   • Upgrade wasmtime to 49.0.4 or later

Other vulnerabilities in wasmtime