CVE-2026-104855: Wasmtime Privilege Escalation Vulnerability

CVE-2026-104855 Overview

Wasmtime, the WebAssembly runtime from the Bytecode Alliance, contains a race condition in bulk operations when embedder callbacks mutate or discard a Store during fuel or epoch preemption checks. The flaw affects versions 46.0.0 through 46.0.1 and the 47.0.x branch before 47.0.3. Bulk WebAssembly operations such as memory.copy, table.grow, and array.copy can expose invalid intermediate state when a Store::epoch_deadline_callback mutates the store, or when embedders continue using a Store after cancellation or a trap. The resulting conditions include null elements in non-nullable tables, invalidated raw pointers into linear memory, and corrupted garbage collection pointers.

Critical Impact
Exploitation can lead to crashes, invalid memory access, or GC heap corruption inside the host embedding Wasmtime.

Affected Products

Wasmtime 46.0.0 through 46.0.1
Wasmtime 47.0.0 through 47.0.2
Embeddings that mutate Store<T> or continue using it after cancellation or a trap

Discovery Timeline

2026-10-02 - CVE-2026-104855 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104855

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] rooted in how Wasmtime inserts fuel and epoch preemption checks inside bulk WebAssembly operations. When an embedder-provided callback runs during such a preemption point, it can observe or modify a Store while a bulk operation is mid-execution.

Three concrete failure modes exist. A cancelled non-nullable table.grow can leave null entries in a table typed as non-nullable, violating a core type invariant. A linear memory growth triggered during memory.copy can invalidate raw pointers that the bulk copy had already cached. A callback-triggered garbage collection during array.copy can invalidate GC pointers held by the in-flight operation.

Embeddings whose callbacks only touch the host data stored in Store<T>, and embeddings that discard the Store after a timeout or epoch deadline, are not affected.

Root Cause

The root cause is that bulk operations held references to runtime state across preemption points where embedder code could run. The code generator in crates/cranelift/src/func_environ/gc.rs inserted preemption checks inside bulk sequences without re-validating or re-fetching the affected state afterward.

Attack Vector

Exploitation requires a malicious or buggy WebAssembly module to execute inside a vulnerable embedding, combined with an embedder that mutates Store<T> from epoch_deadline_callback or continues using the Store after cancellation. The attack is not purely remote and requires embedder participation, which is reflected in the low CVSS v4 score.

rust

// Patch: pre_translate_bulk_op inserted before array allocation
// Source: https://github.com/bytecodealliance/wasmtime/commit/a3eb27af01ba5a30320a90ea1405059cdfedd353
    len: ir::Value,
) -> WasmResult<ir::Value> {
    log::trace!("translate_array_new({array_type_index:?}, {elem:?}, {len:?})");
    func_env.pre_translate_bulk_op(builder, len)?;

    let result =
        gc_compiler(func_env)?.alloc_uninit_array(func_env, builder, array_type_index, len)?;
    let zero = builder.ins().iconst(ir::types::I32, 0);

The fix moves preemption checks to before the bulk operation begins, ensuring no cached pointers or type invariants exist when embedder callbacks run. See commit a3eb27a and commit 99b0bc3 for the backports.

Detection Methods for CVE-2026-104855

Indicators of Compromise

Unexpected host process crashes or segmentation faults originating in Wasmtime bulk-copy or GC code paths
Rust panics referencing table.grow, memory.copy, or array.copy during or after an epoch deadline event
Traps or aborts immediately following execution of a custom epoch_deadline_callback

Detection Strategies

Inventory Rust dependencies and identify builds pinning Wasmtime versions 46.0.0, 46.0.1, 47.0.0, 47.0.1, or 47.0.2
Audit embedder source for calls that mutate Store<T> inside Store::epoch_deadline_callback or that reuse a Store after cancellation or trap
Enable AddressSanitizer or Miri in CI for host binaries embedding Wasmtime to surface memory invalidation issues

Monitoring Recommendations

Collect and alert on host crash dumps that reference Wasmtime symbols in bulk-operation frames
Monitor WebAssembly workload telemetry for unexpected trap rates after epoch deadline tuning changes
Track dependency manifests (Cargo.lock) in production artifacts to detect drift onto affected Wasmtime versions

How to Mitigate CVE-2026-104855

Immediate Actions Required

Upgrade Wasmtime to 46.0.2 on the 46.x branch or 47.0.3 on the 47.x branch
Review all epoch_deadline_callback implementations and limit them to accessing host data in Store<T> only
Discard any Store after a timeout, cancellation, or trap rather than reusing it

Patch Information

Fixed releases are Wasmtime 46.0.2 and Wasmtime 47.0.3. The remediation is tracked in GHSA-2hw9-mc66-jc2q and implemented across pull requests #14041, #14043, and #14045.

Workarounds

Restrict epoch_deadline_callback logic to read-only access of host data within Store<T>
Treat cancellation or trap of a Store as terminal and drop the Store instead of continuing execution
Disable epoch interruption and fuel-based preemption in embeddings that cannot be audited until the patch is deployed

bash

# Update Cargo.toml to a fixed Wasmtime release
cargo update -p wasmtime --precise 47.0.3
# or for the 46.x branch
cargo update -p wasmtime --precise 46.0.2