CVE-2026-115385 Details
Description
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
A denial-of-service vulnerability has been identified in Wasmtime versions 46.0.0 prior to 48.0.4 and 49.0.0 prior to 49.0.2. The issue resides in the wasmtime-wasi implementation of WASIp3, where guests with mutable preopened directory access can cause the Unix host process to abort. This is achieved by calling the set-times or set-times-at methods with negative timestamps before the Unix epoch, which triggers an assertion failure and crashes the host. This vulnerability does not affect Windows hosts or read-only filesystem views.
Users are advised to update to Wasmtime versions 48.0.4 or 49.0.2, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bytecodealliance wasmtime-wasi | >= 46.0.0, < 48.0.4 (semver) >= 49.0.0, < 49.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |