Description (CNA)
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules import WebAssembly tags with a subtype of the original type. Malicious guests can mis-type exception object payloads to corrupt the GC heap, causing Wasmtime to panic when the exceptions proposal is enabled.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| bytecodealliance / wasmtime | affected 47.0.0 before 48.0.4; unaffected 48.0.4; affected 49.0.0 before 49.0.2; unaffected 49.0.2 |
CWE
CWE-1287