CVE-2026-115385: Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 26.0.1+dfsg-3Fixed in 36.0.13+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Unix hosts running affected Wasmtime versions are exposed when they use the wasmtime-wasi WASIp3 implementation and provide a guest with mutable access to a preopened directory.
What does an attacker need to trigger the crash?
An attacker needs the ability to execute or control a WASI guest that has mutable preopened-directory access. The guest can invoke set-times or set-times-at with a negative timestamp expressed as seconds before the Unix epoch.
Is a default Wasmtime configuration known to be affected?
The available information does not establish whether default configuration is affected. Exploitation specifically requires mutable preopened directory access for the guest.
What is the impact of successful exploitation?
Successful exploitation triggers an assertion failure in the WASIp3 implementation and aborts the Unix host process, causing denial of service. No confidentiality or integrity impact is identified in the supplied severity vector.