CVE-2026-115381

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.17 Wasmtime versions 37.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description An unbounded memory allocation exists in the write zeroes method of SinkOutputStream within wasmtime-wasi WASIp2, which serves as the default stream when stdout or stderr are not configured. A malicious WebAssembly guest can trigger this by requesting excessively large zero-filled writes, leading to host memory exhaustion and a resulting denial of service.

Recommendations Update Wasmtime to version 36.0.17 or later. Update Wasmtime to version 48.0.4 or later. Update Wasmtime to version 49.0.2 or later.