CVE-2026-115381: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

Q: Which deployments are exposed to this issue?

Deployments using the affected Wasmtime versions are exposed when they run untrusted or malicious WebAssembly guests and stdout or stderr are left unconfigured, causing Wasmtime to use SinkOutputStream.

Q: What must an attacker be able to do?

An attacker needs the ability to run a malicious WebAssembly guest and induce a write-zeroes call with a very large requested write size. The attack can exhaust host memory and cause denial of service; no confidentiality or integrity impact is described.

Q: Are default stream settings affected?

Yes. SinkOutputStream is the default stream when stdout or stderr are not configured, so applications that omit stream configuration can be affected.

Q: Which versions contain fixes?

The issue is fixed in Wasmtime 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2.

Published Oct 22, 2026

Updated

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

Affected Software

1 affected component

Bytecode Alliance Wasmtime<36.0.17, >=37.0.0<48.0.4, >=49.0.0<49.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wasmtime to a version that resolves this vulnerability.
Fixed in 36.0.17

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected Wasmtime versions are exposed when they run untrusted or malicious WebAssembly guests and stdout or stderr are left unconfigured, causing Wasmtime to use SinkOutputStream.

What must an attacker be able to do?

An attacker needs the ability to run a malicious WebAssembly guest and induce a write-zeroes call with a very large requested write size. The attack can exhaust host memory and cause denial of service; no confidentiality or integrity impact is described.

Are default stream settings affected?

Yes. SinkOutputStream is the default stream when stdout or stderr are not configured, so applications that omit stream configuration can be affected.

Which versions contain fixes?

The issue is fixed in Wasmtime 36.0.17, 48.0.4, and 49.0.2. Affected ranges are versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2.

CVE-2026-115381: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do?

Are default stream settings affected?

Which versions contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker be able to do?

Are default stream settings affected?

Which versions contain fixes?