CVE-2026-115385 json
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps
published 2026-10-02 38 d ago modified 2026-10-26 13 d ago also EUVD-2026-108313 , GHSA-mr2v-56j5-cmfc , RUSTSEC-2026-0324
- cvss
- 6.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.
Patch / fix
- crates.io wasmtime-wasi 48.0.4, 49.0.2
- bytecodealliance wasmtime 48.0.4, 49.0.2
- github.com/bytecodealliance/wasmtime#14486 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 d ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wasmtime-wasi | >=46.0.0, <48.0.4 >=49.0.0, <49.0.2 |
48.0.4 49.0.2 |
Affected products
- bytecodealliance wasmtime
Classification
- Weakness
-
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
-
github.com
/bytecodealliance/wasmtime/pull/14486
web
-
github.com
/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc
vendor-advisory
-
vulncheck.com
/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-host-panic-via-wasip3-timestamps
third-party-advisory
-
crates.io
/crates/wasmtime-wasi
package
-
rustsec.org
/advisories/RUSTSEC-2026-0324.html
advisory
Sources
- CVE List CVE-2026-115385
- NVD CVE-2026-115385
- OSV RUSTSEC-2026-0324
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.