CVE-2026-115387 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that all

What is CVE-2026-115387?

CVE-2026-115387 is a medium-severity vulnerability in bytecodealliance wasmtime, published on 22 Oct 2026.

Official description

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the seconds field to path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at, crashing the host.

Weakness: CWE-190

Which versions are affected by CVE-2026-115387?

1 open source package ship an affected version, including wasmtime-wasi.

How do I fix CVE-2026-115387?

Upgrade wasmtime-wasi to a fixed version for your release line: 36.0.16, 48.0.3 or 49.0.1.

Is CVE-2026-115387 being exploited?

There is no known exploitation of CVE-2026-115387 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-115387, GHSA-j2g9-4prp-pf6h, GHSA-xxx8-c5qx-wvm3, RUSTSEC-2026-0314, UBUNTU-CVE-2026-115387.