6.9 Medium

CVE-2026-115387 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflow

Description

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.

CVSS 4.0 detail

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable with local access to the machine, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: None
Integrity: None
Availability: High
Confidentiality of other systems: None
Integrity of other systems: None
Availability of other systems: None

Affected products and versions

Product	Affected versions	Fixed in
wasmtime 49.0	49.0.0 → < 49.0.1	49.0.1
wasmtime 48.0	earliest → < 48.0.3	48.0.3
wasmtime 37.0	37.0.0 → < 48.0.3	48.0.3
wasmtime 36.0	earliest → < 36.0.16	36.0.16

References

Timeline

Published October 22, 2026
Last modified November 4, 2026

The 81 CVEs of wasmtime →

CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in… 6.3 Medium CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the… 6.3 Medium CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3… 6.9 Medium CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 5.9 Medium

Track this CVE