CVE-2026-126410

Name of the Vulnerable Software and Affected Versions wasmtime-wasi versions 48.0.0 through 48.0.7 wasmtime-wasi versions 49.0.0 through 49.0.4 wasmtime-wasi versions 50.0.0

Description A time-of-check/time-of-use (TOCTOU) race condition exists in the wasip3 wasi:sockets udp-socket host implementation. This flaw allows guests to bypass send restrictions enforced by the socket addr check function. A malicious guest can exploit this by racing udp-socket.send against udp-socket.connect to send attacker-controlled datagrams to addresses that the policy only permits for receiving.

Recommendations Update wasmtime-wasi to version 48.0.8 or later. Update wasmtime-wasi to version 49.0.5 or later. Update wasmtime-wasi to version 50.0.1 or later.