CVE-2026-115379

Name	CVE-2026-115379
Description	Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-wasmtime (PTS)	trixie	26.0.1+dfsg-3	fixed
	forky, sid	36.0.13+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-wasmtime	source	(unstable)	(not affected)

Notes

- rust-wasmtime <not-affected> (Only affects 47 and later)
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf
https://rustsec.org/advisories/RUSTSEC-2026-0326.html