Skip to content
Sign in
6.5 Medium

CVE-2026-58494 Wasmtime is a runtime for WebAssembly

Description

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

Affected products and versions

Product Affected versions Fixed in
wasmtime 46.0 46.0.0 → < 46.0.1 46.0.1
wasmtime 37.0 37.0.0 → < 45.0.3 45.0.3
wasmtime 25.0 25.0.0 → < 36.0.12 36.0.12
wasmtime 24.0 earliest → < 24.0.11 24.0.11

Other CVEs of wasmtime

The 81 CVEs of wasmtime →
CVE-2026-121441 Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in… 6.3 Medium CVE-2026-121440 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the… 6.3 Medium CVE-2026-121439 Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3… 6.9 Medium CVE-2026-119143 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes 5.9 Medium
Track this CVE