Vulnerability-Lookup

CVE-2026-104855 (GCVE-0-2026-104855)

Vulnerability from cvelistv5 – Published: 2026-10-02 17:37 – Updated: 2026-10-06 16:38

Title

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Summary

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store<T>, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.

Severity

2 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 16:38 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7553 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/bytecodealliance/wasmtime/secu…	x_refsource_CONFIRM
https://github.com/bytecodealliance/wasmtime/pull/14041	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/pull/14043	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/pull/14045	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/comm…	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/comm…	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/comm…	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/rele…	x_refsource_MISC
https://github.com/bytecodealliance/wasmtime/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
bytecodealliance	wasmtime	Affected: >= 46.0.0, < 46.0.2 Affected: >= 47.0.0, < 47.0.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:38:25.082584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T16:38:35.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 46.0.0, \u003c 46.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 47.0.0, \u003c 47.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store\u003cT\u003e, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T17:37:50.941Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/pull/14041",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/pull/14043",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/pull/14045",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
        },
        {
          "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-2hw9-mc66-jc2q",
        "discovery": "UNKNOWN"
      },
      "title": "Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104855",
    "datePublished": "2026-10-02T17:37:50.941Z",
    "dateReserved": "2026-10-02T14:38:43.244Z",
    "dateUpdated": "2026-10-06T16:38:35.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-104855",
      "date": "2026-10-08",
      "epss": "0.00276",
      "percentile": "0.18396"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "wasmtime",
                "vendor": "bytecodealliance",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 46.0.0, \u003c 46.0.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 47.0.0, \u003c 47.0.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store\u003cT\u003e, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3."
          }
        ],
        "id": "CVE-2026-104855",
        "lastModified": "2026-10-06T17:17:16.000",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 2.0,
                "baseSeverity": "LOW",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-104855",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:38:25.082584Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-02T18:17:02.083",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-02T19:50:14+00:00",
      "cve": "CVE-2026-104855",
      "id": "CVE-2026-104855",
      "initial_release_date": "2026-10-02T17:37:50.941000+00:00",
      "product_status:known_affected": "4",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "wasmtime: wasmtime: Memory corruption via preemption checks during bulk operations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104855.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-05T16:28:40Z",
      "cve": "CVE-2026-104855",
      "id": "CVE-2026-104855",
      "initial_release_date": "2026-10-05T16:28:40Z",
      "product_status:known_affected": "21",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-104855",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-104855.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-104855",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T16:38:25.082584Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T16:38:30.432Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "wasmtime",
              "vendor": "bytecodealliance",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 46.0.0, \u003c 46.0.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 47.0.0, \u003c 47.0.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store\u003cT\u003e, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 2,
                "baseSeverity": "LOW",
                "privilegesRequired": "HIGH",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-362",
                  "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-02T17:37:50.941Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/pull/14041",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/pull/14043",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/pull/14045",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
            },
            {
              "name": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
            }
          ],
          "source": {
            "advisory": "GHSA-2hw9-mc66-jc2q",
            "discovery": "UNKNOWN"
          },
          "title": "Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-104855",
        "datePublished": "2026-10-02T17:37:50.941Z",
        "dateReserved": "2026-10-02T14:38:43.244Z",
        "dateUpdated": "2026-10-06T16:38:35.157Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-104855

Vulnerability from fkie_nvd - Published: 2026-10-02 18:17 - Updated: 2026-10-06 17:17

Severity

2.0 (Low) - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/pull/14041
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/pull/14043
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/pull/14045
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3
	security-advisories@github.com	https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wasmtime",
          "vendor": "bytecodealliance",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 46.0.0, \u003c 46.0.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 47.0.0, \u003c 47.0.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store\u003cT\u003e, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3."
    }
  ],
  "id": "CVE-2026-104855",
  "lastModified": "2026-10-06T17:17:16.000",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-104855",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-06T16:38:25.082584Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-02T18:17:02.083",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2HW9-MC66-JC2Q

Vulnerability from github – Published: 2026-10-02 22:45 – Updated: 2026-10-02 22:45

Summary

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Details

Impact

Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include:

When a non-nullable WebAssembly table is grown the new elements initially start as null and are filled in as part of a loop with preemption checks. If this computation is then cancelled this left the table in a grown-but-uninitialized state where subsequent usage via WebAssembly could possibly segfault. Loads from this table are assumed to not be null due to its type, but the runtime implementation was exposed through this cancellation at a preemption point.
Embedders could mutate the store during an epoch callback, such as growing a WebAssembly linear memory. During a bulk memory.copy operation, however, the pointers being copied to/from weren't recomputed between preemption points. This meant that if the linear memory moved its base address it could be possible to have a preemption, the embedder manually grows memory, and then on resumption the copy operation uses invalid pointers.
Embedders could execute a GC during epoch callbacks. GC operations such as array.copy, like memory.copy above, maintained raw pointers internally in the operation which were not updated after the preemption point. This could lead to corruption of the GC heap.

All of these situations are examples of embedder-driven mutations of the Store or embedder-induced resumption of a Store after a computation was cancelled. These operations expose the internal state of these WebAssembly operations which is semantically incorrect and additionally can cause segfaults for example. Exposing these bugs, however, requires explicit patterns to be present in the embedding itself such as using Store::epoch_deadline_callback and mutating wasm options. Another example is to cancel one invocation (possibly in a table.grow) and then execute more wasm afterwards within the same store. Embeddings not using Store::epoch_deadline_callback or executing code after timeouts/fuel are not affected by this issue.

Patches

This issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large memory.copy does not have preemption points in the middle of the operation any more, for example.

Workarounds

Embedders using Store::epoch_deadline_callback are safe if they only access the T in Store<T>. Embedders that do not continue using a store after a timeout or epoch deadline are also unaffected. Embedders which explicitly mutate the store in an epoch callback, or resume wasm after trapping have no workaround however. The embedding needs to be updated to account for this issue.

Severity

2.0 (Low)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "46.0.0"
            },
            {
              "fixed": "46.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "47.0.0"
            },
            {
              "fixed": "47.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104855"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T22:45:29Z",
    "nvd_published_at": "2026-10-02T18:17:02Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nWasmtime\u0027s implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store\u0027s state or cancelling a computation. To prevent these operations from taking too long Wasmtime injects fuel/epoch checks during these operations, but this enables embedders, and possible WebAssembly, to witness intermediate state in the middle of the operation. Examples of this include:\n\n* When a non-nullable WebAssembly table is grown the new elements initially start as null and are filled in as part of a loop with preemption checks. If this computation is then cancelled this left the table in a grown-but-uninitialized state where subsequent usage via WebAssembly could possibly segfault. Loads from this table are assumed to not be null due to its type, but the runtime implementation was exposed through this cancellation at a preemption point.\n* Embedders could mutate the store during an epoch callback, such as growing a WebAssembly linear memory. During a bulk `memory.copy` operation, however, the pointers being copied to/from weren\u0027t recomputed between preemption points. This meant that if the linear memory moved its base address it could be possible to have a preemption, the embedder manually grows memory, and then on resumption the copy operation uses invalid pointers.\n* Embedders could execute a GC during epoch callbacks. GC operations such as `array.copy`, like `memory.copy` above, maintained raw pointers internally in the operation which were not updated after the preemption point. This could lead to corruption of the GC heap.\n\nAll of these situations are examples of embedder-driven mutations of the `Store` or embedder-induced resumption of a `Store` after a computation was cancelled. These operations expose the internal state of these WebAssembly operations which is semantically incorrect and additionally can cause segfaults for example. Exposing these bugs, however, requires explicit patterns to be present in the embedding itself such as using `Store::epoch_deadline_callback` and mutating wasm options. Another example is to cancel one invocation (possibly in a `table.grow`) and then execute more wasm afterwards within the same store. Embeddings not using `Store::epoch_deadline_callback` or executing code after timeouts/fuel are not affected by this issue.\n\n### Patches\n\nThis issue is fixed in Wasmtime 46.0.2 and 47.0.3. In these versions Wasmtime reverts back to Wasmtime 45-and-earlier behavior for these operations to check fuel once before the operation and then not during the operation. This means that a very large `memory.copy` does not have preemption points in the middle of the operation any more, for example.\n\n### Workarounds\n\nEmbedders using `Store::epoch_deadline_callback` are safe if they only access the `T` in `Store\u003cT\u003e`. Embedders that do not continue using a store after a timeout or epoch deadline are also unaffected. Embedders which explicitly mutate the store in an epoch callback, or resume wasm after trapping have no workaround however. The embedding needs to be updated to account for this issue.",
  "id": "GHSA-2hw9-mc66-jc2q",
  "modified": "2026-10-02T22:45:29Z",
  "published": "2026-10-02T22:45:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104855"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytecodealliance/wasmtime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0223.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state"
}

RUSTSEC-2026-0223 (CVE-2026-104855)

Vulnerability from osv_rustsec – Published: 2026-07-31 12:00 – Updated: 2026-10-03 07:19 – Source website

Summary

Preemption and traps during bulk operations enable breaking internal VM state

Details

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q For more information see the GitHub-hosted security advisory.

Severity

2.0 (Low)


                    
                      CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

URL

Type

	https://crates.io/crates/wasmtime	PACKAGE
	https://rustsec.org/advisories/RUSTSEC-2026-0223.html	ADVISORY
	https://github.com/bytecodealliance/wasmtime/secu…	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "wasmtime",
        "purl": "pkg:cargo/wasmtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "46.0.0"
            },
            {
              "fixed": "46.0.2"
            },
            {
              "introduced": "47.0.0"
            },
            {
              "fixed": "47.0.3"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2026-104855",
    "GHSA-2hw9-mc66-jc2q"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q\nFor more information see the GitHub-hosted security advisory.",
  "id": "RUSTSEC-2026-0223",
  "modified": "2026-10-03T07:19:45Z",
  "published": "2026-07-31T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/wasmtime"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0223.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Preemption and traps during bulk operations enable breaking internal VM state"
}

UBUNTU-CVE-2026-104855 (CVE-2026-104855)

Vulnerability from osv_ubuntu – Published: 2026-10-02 18:17 – Updated: 2026-10-08 09:54 – Source website

Details

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.

Severity

2.0 (Low)


                    
                      CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-104855	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-104855	REPORT
	https://github.com/bytecodealliance/wasmtime/secu…	REPORT
	https://github.com/bytecodealliance/wasmtime/comm…	REPORT
	https://github.com/bytecodealliance/wasmtime/comm…	REPORT
	https://github.com/bytecodealliance/wasmtime/comm…	REPORT
	https://github.com/bytecodealliance/wasmtime/pull/14041	REPORT
	https://github.com/bytecodealliance/wasmtime/pull/14043	REPORT
	https://github.com/bytecodealliance/wasmtime/pull/14045	REPORT
	https://github.com/bytecodealliance/wasmtime/rele…	REPORT
	https://github.com/bytecodealliance/wasmtime/rele…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.103.0+16.0.0+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@16.0.0+dfsg-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.1+dfsg-7",
        "15.0.1+dfsg-4",
        "16.0.0+dfsg-2",
        "16.0.0+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "librust-cranelift-dev",
            "binary_version": "0.123.5+36.0.5+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rust-wasmtime",
        "purl": "pkg:deb/ubuntu/rust-wasmtime@36.0.5+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "26.0.1+dfsg-3",
        "26.0.1+dfsg-4",
        "28.0.1+dfsg-3",
        "29.0.1+dfsg-5",
        "36.0.5+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mutates a Store in Store::epoch_deadline_callback or continues using a Store after cancellation or a trap. A cancelled non-nullable table growth can leave null elements, linear-memory growth during memory.copy can invalidate retained raw pointers, and callback-triggered garbage collection during array.copy can invalidate GC pointers, resulting in a crash, invalid memory access, or GC heap corruption. Embeddings whose callbacks only access the host data in Store\u003cT\u003e, and embeddings that discard a Store after timeout or epoch deadline, are not affected. This issue is fixed in versions 46.0.2 and 47.0.3.",
  "id": "UBUNTU-CVE-2026-104855",
  "modified": "2026-10-08T09:54:47Z",
  "published": "2026-10-02T18:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-104855"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104855"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/3ebfbe5af4927c157d6fcaca42b8dbb6d17b73fb"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/99b0bc39d447317a4102c056081c83a9a84a46e0"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14041"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14043"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/pull/14045"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.2"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v47.0.3"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-104855"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-104855 (GCVE-0-2026-104855)

FKIE_CVE-2026-104855

GHSA-2HW9-MC66-JC2Q

Impact

Patches

Workarounds

RUSTSEC-2026-0223 (CVE-2026-104855)

UBUNTU-CVE-2026-104855 (CVE-2026-104855)

Tags

Sightings

Nomenclature

Related by attack behaviour