CVE-2026-115386: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fdreaddir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rust-wasmtimeto a version that resolves this vulnerability.Fixed in 36.0.20+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed?
Wasmtime deployments are exposed when they run an affected version and provide a WebAssembly guest with a preopened directory. The affected WASI Preview 1 fd_readdir path can disclose data when that guest lists directory entries.
What does an attacker need to exploit this?
An attacker needs to control or execute a guest that can call fd_readdir and has access to a preopened directory. Exploitation also requires successfully listing entries in that directory.
How much data can be disclosed?
The guest can receive three bytes of leftover host stack or heap memory for each directory entry returned by fd_readdir. The disclosed bytes are uninitialized struct padding.
Which versions should be remediated?
Upgrade to Wasmtime 36.0.17, 48.0.4, or 49.0.2 or later, as applicable to the release line in use. Versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2 are affected.
What can be done if an upgrade is not immediately possible?
Do not grant untrusted guests preopened directories, or prevent them from listing entries in such directories. This removes the fd_readdir access condition described for the disclosure.