Live › vulnerability › CVE-2026-115387
Go to dashboardWasmtime's WASI filesystem code panics the host when a guest program passes timestamp values whose sub-second field overflows the seconds field to set-times calls. An attacker running a WASI guest program can crash the host process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that embed Wasmtime with the wasmtime-wasi crate, or run WASI guest programs on a Wasmtime host, on the affected version ranges. Hosts that run only trusted guest code or do not expose filesystem WASI APIs to guests are less exposed. Users of other runtimes or of Wasmtime versions outside the listed ranges can skip it.
No product ranges from the sources yet.
wasmtime --version and compare against the fixed lines: 36.0.16, 48.0.3, 49.0.1wasmtime-wasi version36.0.16, 48.0.3, or 49.0.1, whichever matches your release linewasmtime-wasiEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.
This page as .md · .json · in your agent: get_signal("CVE-2026-115387")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.