CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

Description

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.

Exploitable remotely over the network, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

High

Attack requirements

Present

Privileges required

Low

Interaction

Passive

Confidentiality

None

Integrity

None

Availability

High

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions