Live › vulnerability › CVE-2026-115386
Go to dashboardWasmtime's WASIp1 fd_readdir copies uninitialized struct padding into guest memory. A guest with a preopened directory can list entries and read three bytes of leftover host stack or heap memory per entry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that embed Wasmtime to run untrusted WebAssembly guests that use WASIp1 and have preopened directories exposed to them. Hosts that run only trusted guests, or that do not preopen directories, have a much smaller exposure. Teams that do not embed Wasmtime can skip this.
No product ranges from the sources yet.
wasmtime --version and compare against the fixed versions.wasmtime crate or bindings at versions before 36.0.17, 37.0.0 to 48.0.3, or 49.0.0 to 49.0.1.36.0.17, 48.0.4, or 49.0.2 depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
This page as .md · .json · in your agent: get_signal("CVE-2026-115386")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.