« Volver al listado

CVE-2026-104855

Estado: AplazadaBaja (2)—

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap.

Leer descripción completaMostrar menos

A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store<T>, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Requiere interacción del usuario (UI:P) para mutar Store en callbacks. Impactos: crash/DoS por corrupción de memoria en operaciones bulk, e invalidación de punteros que causa corrupción de heap GC.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory PermissionsRemote Data StorageFilter Network TrafficEncrypt Sensitive InformationApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bytecodealliance — WasmtimeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-104855",
  "cveTags": [],
  "metrics": {
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bytecodealliance",
          "product": "wasmtime",
          "versions": [
            {
              "status": "affected",
              "version": ">= 46.0.0, < 46.0.2"
            },
            {
              "status": "affected",
              "version": ">= 47.0.0, < 47.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-02T18:17:02.083",
  "references": [
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14041",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14043",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14045",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store<T>, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3."
    }
  ],
  "lastModified": "2026-10-02T18:17:02.220",
  "sourceIdentifier": "security-advisories@github.com"
}