CVE-2026-115386

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 36.0.17 Wasmtime versions 37.0.0 through 48.0.3 Wasmtime versions 49.0.0 through 49.0.1

Description An information disclosure issue exists in the WASIp1 fd readdir() implementation. The flaw allows the copying of uninitialized struct padding into guest memory. Consequently, guests with a preopened directory can list entries to obtain three bytes of leftover host stack or heap memory for each directory entry.

Recommendations Update Wasmtime to version 36.0.17 or later. Update Wasmtime to version 48.0.4 or later. Update Wasmtime to version 49.0.2 or later.