CVE-2026-115386

Low

Description

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.

SeverityLow

CVSS2.6

Exploit probability—

ProductBytecodealliance Wasmtime

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-908CWE-908

How to fix

Update

bytecodealliance wasmtime36.0.17, 48.0.4, 49.0.2 or later

Vendor advisories

github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24

Affected products

Product	Affected versions	Fixed in
bytecodealliance wasmtime	v < 36.0.17, 37.0.0 ≤ v < 48.0.4, 49.0.0 ≤ v < 49.0.2	36.0.17, 48.0.4, 49.0.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.