CVE-2026-115386: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir

Q: Which deployments are exposed?

Wasmtime deployments are exposed when they run an affected version and provide a WebAssembly guest with a preopened directory. The affected WASI Preview 1 fd_readdir path can disclose data when that guest lists directory entries.

Q: What does an attacker need to exploit this?

An attacker needs to control or execute a guest that can call fd_readdir and has access to a preopened directory. Exploitation also requires successfully listing entries in that directory.

Q: How much data can be disclosed?

The guest can receive three bytes of leftover host stack or heap memory for each directory entry returned by fd_readdir. The disclosed bytes are uninitialized struct padding.

Q: Which versions should be remediated?

Upgrade to Wasmtime 36.0.17, 48.0.4, or 49.0.2 or later, as applicable to the release line in use. Versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2 are affected.

Q: What can be done if an upgrade is not immediately possible?

Do not grant untrusted guests preopened directories, or prevent them from listing entries in such directories. This removes the fd_readdir access condition described for the disclosure.

Published Oct 22, 2026

Updated

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fdreaddir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.

Affected Software

1 affected component

Bytecode Alliance Wasmtime<36.0.17, >=37.0.0<48.0.4, >=49.0.0<49.0.2

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Wasmtime deployments are exposed when they run an affected version and provide a WebAssembly guest with a preopened directory. The affected WASI Preview 1 fd_readdir path can disclose data when that guest lists directory entries.

What does an attacker need to exploit this?

An attacker needs to control or execute a guest that can call fd_readdir and has access to a preopened directory. Exploitation also requires successfully listing entries in that directory.

How much data can be disclosed?

The guest can receive three bytes of leftover host stack or heap memory for each directory entry returned by fd_readdir. The disclosed bytes are uninitialized struct padding.

Which versions should be remediated?

Upgrade to Wasmtime 36.0.17, 48.0.4, or 49.0.2 or later, as applicable to the release line in use. Versions before 36.0.17, versions from 37.0.0 before 48.0.4, and versions from 49.0.0 before 49.0.2 are affected.

What can be done if an upgrade is not immediately possible?

Do not grant untrusted guests preopened directories, or prevent them from listing entries in such directories. This removes the fd_readdir access condition described for the disclosure.

CVE-2026-115386: Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

How much data can be disclosed?

Which versions should be remediated?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

How much data can be disclosed?

Which versions should be remediated?

What can be done if an upgrade is not immediately possible?