CVE-2026-104855
published 2026-10-02CVE-2026-104855: Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy…
PriorityP413low2CVSS 4.0
AVNACHATPPRHUIPVCNVILVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
19.0th percentile
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | — | — |
| bytecodealliance | wasmtime | >= 46.0.0 < 46.0.2 | 46.0.2 |
| bytecodealliance | wasmtime | >= 47.0.0 < 47.0.3 | 47.0.3 |
| rhcl-1 | wasm-shim-rhel9 | — | — |
CVSS provenance
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
ghsa·2026-10-02
CVE-2026-104855 [LOW] CWE-362 Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
### Impact
Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include:
* When a non-nullable WebAssembly table is grown the new elements initially start as null and are filled in as part of a loop with preemption checks. If this computation is then cancelled this left the table in a gr
VulDB
Bytecode Alliance Wasmtime up to 46.0.1/47.0.2 Fuel/Epoch Preemption Checks epoch_deadline_callback heap-based overflow
vuldb·2026-10-02·CVSS 2.0
CVE-2026-104855 [LOW] Bytecode Alliance Wasmtime up to 46.0.1/47.0.2 Fuel/Epoch Preemption Checks epoch_deadline_callback heap-based overflow
A vulnerability labeled as problematic has been found in Bytecode Alliance Wasmtime up to 46.0.1/47.0.2. Affected is the function Store::epoch_deadline_callback of the component Fuel/Epoch Preemption Checks. Such manipulation leads to heap-based buffer overflow.
This vulnerability is uniquely identified as CVE-2026-104855. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
Red Hat
wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
vendor_redhat·2026-10-02·CVSS 2.0
CVE-2026-104855 [LOW] CWE-1265 wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
A flaw was found in wasmtime. Execution preemption checks during bulk operations can expose an invalid intermediate state if an application mutates or continues using the execution store after a cancellation or trap. Under these conditions, an attacker executing WebAssembly code can cause memory corruption, invalid memory access, or an application crash resulting in a Denial of Service (DoS).
Package: rhcl-1/wasm-shim-rhel9 (Red Hat Connectivity Link 1) - Fix deferred
Package: tree-sitter (Red Hat Enterprise Linux 10) - Fix deferred
Package: virt-firmware-rs (Red Hat Enterprise Linux 10) - Fix deferred
Package: openshell (Red Hat Hardened Images) - Not affected
Package: rust (Red Hat Hardened Images) -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-104855 tree-sitter0.25: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
bugzilla·2026-10-08·CVSS 2.0
CVE-2026-104855 [LOW] CVE-2026-104855 tree-sitter0.25: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
CVE-2026-104855 tree-sitter0.25: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can inva
Bugzilla
CVE-2026-104855 tree-sitter: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
bugzilla·2026-10-08·CVSS 2.0
CVE-2026-104855 [LOW] CVE-2026-104855 tree-sitter: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
CVE-2026-104855 tree-sitter: wasmtime: Memory corruption via preemption checks during bulk operations [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalida
Bugzilla
CVE-2026-104855 wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
bugzilla·2026-10-02·CVSS 2.0
CVE-2026-104855 [LOW] CVE-2026-104855 wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
CVE-2026-104855 wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Sto
https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fbhttps://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353https://github.com/bytecodealliance/wasmtime/pull/14041https://github.com/bytecodealliance/wasmtime/pull/14043https://github.com/bytecodealliance/wasmtime/pull/14045https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q
2026-10-02
Published