{"id":"CVE-2026-115387","kind":"vulnerability","aliases":["CVE-2026-115387"],"related":[],"title":"Wasmtime: overflowing filesystem timestamps let a guest program crash the host","description":"Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.","summary":"Wasmtime's WASI filesystem code panics the host when a guest program passes timestamp values whose sub-second field overflows the seconds field to set-times calls. An attacker running a WASI guest program can crash the host process, causing denial of service.","severity":"medium","cvss":6.9,"epss":0.00112,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wasi","wasmtime","webassembly"],"not_affected_if":["no-filesystem-wasi","trusted-guest-only"],"how_to_check":"- Run `wasmtime --version` and compare against the fixed lines: `36.0.16`, `48.0.3`, `49.0.1`\n- Check the Cargo.lock of embedding applications for the `wasmtime-wasi` version","fix":"- Upgrade Wasmtime to `36.0.16`, `48.0.3`, or `49.0.1`, whichever matches your release line\n- Rebuild embedding applications so they pick up the patched `wasmtime-wasi`","status":"open","published_at":"2026-10-22T19:17:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:38:45+00:00","updated_at":"2026-10-25T03:38:45+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:38:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Wasmtime to `36.0.16`, `48.0.3`, or `49.0.1`, whichever matches your release line\n- Rebuild embedding applications so they pick up the patched `wasmtime-wasi`","reach":"unknown","title":"Wasmtime: overflowing filesystem timestamps let a guest program crash the host","impact":"medium","summary":"Wasmtime's WASI filesystem code panics the host when a guest program passes timestamp values whose sub-second field overflows the seconds field to set-times calls. An attacker running a WASI guest program can crash the host process, causing denial of service.","category":"runtime","nicknames":[],"who_cares":["wasmtime","wasi","webassembly","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"A guest program crashes the host process, denying service.","analyst_note":"","how_to_check":"- Run `wasmtime --version` and compare against the fixed lines: `36.0.16`, `48.0.3`, `49.0.1`\n- Check the Cargo.lock of embedding applications for the `wasmtime-wasi` version","needs_analyst":false,"not_affected_if":["trusted-guest-only","no-filesystem-wasi"],"who_is_affected":"Teams that embed Wasmtime with the wasmtime-wasi crate, or run WASI guest programs on a Wasmtime host, on the affected version ranges. Hosts that run only trusted guest code or do not expose filesystem WASI APIs to guests are less exposed. Users of other runtimes or of Wasmtime versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":3442,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115387':14A,17A '-2026':13A,16A '36.0.16':72C '37.0.0':73C '48.0.3':75C '49.0.0':77C '49.0.1':79C 'allow':91C 'atim':106C 'attack':55B,103C 'call':53B 'caus':66B 'code':29B 'contain':80C 'crash':9A,62B,136C 'cve':12A,15A 'denial':67B,82C 'fd':124C 'field':44B,48B,114C,118C 'filestat':121C,125C 'filesystem':3A,28B,101C 'guest':7A,35B,59B,92C 'host':11A,21B,32B,64B,98C,138C 'let':5A 'mtim':108C 'overflow':2A,45B,100C,115C 'panic':30B,96C 'pass':37B,105C 'path':120C 'process':65B 'program':8A,36B,60B,94C 'run':56B 'runtim':18B 'second':43B,47B,113C,117C 'self':20B 'self-host':19B 'servic':69B,84C 'set':51B,122C,126C,129C,133C 'set-tim':50B,128C 'set-times-at':132C 'sub':42B,112C 'sub-second':41B,111C 'time':52B,123C,127C,130C,134C 'timestamp':4A,38B,102C 'valu':39B,109C 'via':99C 'vulner':85C 'wasi':22B,27B,58B,89C,93C 'wasmtim':1A,23B,25B,70C,88C 'wasmtime-wasi':87C 'webassembl':24B 'whose':40B,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that embed Wasmtime with the wasmtime-wasi crate, or run WASI guest programs on a Wasmtime host, on the affected version ranges. Hosts that run only trusted guest code or do not expose filesystem WASI APIs to guests are less exposed. Users of other runtimes or of Wasmtime versions outside the listed ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115387","severity":null,"published_at":"2026-10-22T19:17:46+00:00","modified_at":"2026-10-22T19:17:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115387","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115387","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}