Description
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bytecodealliance | wasmtime | 49.0.0 <49.0.5 | — |
| bytecodealliance | wasmtime | 47.0.0 <48.0.8 | — |
| bytecodealliance | wasmtime | 50.0.0 <50.0.1 | — |