Live › vulnerability › CVE-2026-115385
Go to dashboardWasmtime's WASIp3 implementation in wasmtime-wasi asserts when a guest passes a negative (pre-epoch) seconds value to set-times or set-times-at. A guest with mutable preopened directory access can use this to abort the host process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that embed Wasmtime on Unix and run untrusted or third-party WebAssembly guests that have been granted mutable preopened directory access through WASIp3. A host that only runs trusted guests, or grants no preopened directories, is much less exposed. Hosts on the affected version ranges with no WASIp3 usage can deprioritise this.
No product ranges from the sources yet.
wasmtime --version and compare against the affected ranges: 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2.48.0.4 or 49.0.2 (or a later release in the same line).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
This page as .md · .json · in your agent: get_signal("CVE-2026-115385")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.