CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-115386?
CVE-2026-115386 is a low-severity vulnerability in bytecodealliance wasmtime, published on 22 Oct 2026.
Official description
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Weakness: CWE-908
Which versions are affected by CVE-2026-115386?
1 open source package ship an affected version, including wasmtime-wasi.
| Package | Affected | Fixed in |
|---|---|---|
wasmtime-wasi crates.io | From 0.0.0-0 | 36.0.17, 48.0.4, 49.0.2 |
How do I fix CVE-2026-115386?
Upgrade wasmtime-wasi to a fixed version for your release line: 36.0.17, 48.0.4 or 49.0.2.
Is CVE-2026-115386 being exploited?
There is no known exploitation of CVE-2026-115386 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-115386, GHSA-7vfm-vg2r-wpmh, GHSA-96f6-r43r-8c24, RUSTSEC-2026-0323, UBUNTU-CVE-2026-115386.