https://vulnerability.circl.lu/sightings/feed 2026-10-03T23:40:40.806306+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/86c3560a-ffa0-469f-be5e-572db38b83d1/export 2026-10-03T23:40:40.836098+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "86c3560a-ffa0-469f-be5e-572db38b83d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104855", "type": "seen", "source": "https://gist.github.com/alon710/a0ca06f289edb2a99a12936f2ba8cda3", "content": "# CVE-2026-104855: CVE-2026-104855: Sandbox Escape via Reentrant State Desynchronization in Wasmtime Bulk Memory Operations\n\n> **CVSS Score:** 2.0\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-104855\n\n## Summary\nCVE-2026-104855 is a critical vulnerability involving a race condition and reentrant state desynchronization within Wasmtime, a standalone WebAssembly runtime. Due to incremental mid-operation preemption points in compiler-generated loops for bulk memory and table operations, a host-defined epoch or fuel deadline callback could mutate the WebAssembly Store. Upon resuming, the virtual machine utilized stale cached pointers, resulting in use-after-free, out-of-bounds writes, and sandbox escape.\n\n## TL;DR\nA state desynchronization flaw in Wasmtime's bulk operations allowed host reentrancy during loop preemption checks. Under specific configurations, a callback could modify the linear memory layout or garbage-collection heap, causing the resumed loop to perform use-after-free operations or out-of-bounds writes, potentially leading to WebAssembly sandbox escape.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)\n- **Attack Vector**: Network / Local\n- **CVSS Score**: 2.0 (Low Base / Critical Downstream Impact)\n- **EPSS Score**: Not Listed\n- **Impact**: Sandbox Escape, Memory Corruption (Use-After-Free, Out-of-Bounds Write)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Wasmtime standalone WebAssembly runtime\n- **Wasmtime**: >= 46.0.0, < 46.0.2 (Fixed in: `46.0.2`)\n- **Wasmtime**: >= 47.0.0, < 47.0.3 (Fixed in: `47.0.3`)\n\n## Mitigation\n\n- Upgrade to Wasmtime 46.0.2, 47.0.3, or later versions.\n- Avoid mutating critical Store resources (such as growing memory or tables) within user-defined host epoch or fuel deadline callbacks.\n- Implement resource limiters to prevent guest modules from performing excessively large, non-preemptible bulk memory copies that could lead to CPU thread starvation.\n\n**Remediation Steps:**\n1. Update cargo.toml dependencies for bytecodealliance/wasmtime to at least 46.0.2 or 47.0.3.\n2. Run `cargo update` in the project root to fetch the updated crate version.\n3. Audit all registered epoch_deadline_callback and set_fuel callback implementations for potential reentrant mutations to the store state.\n\n## References\n\n- [GHSA-2hw9-mc66-jc2q](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q)\n- [CVE-2026-104855 Record](https://www.cve.org/CVERecord?id=CVE-2026-104855)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-104855) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-03T10:30:31.000000Z"} 2026-10-03T10:30:31+00:00