CVE-2026-115386 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments, especially those using wasmtime-wasi, should assess exposure and potential impacts. They should prioritize verifying exposure and assessing the need for updates or mitigations based on the provided version ranges and potential impacts on guest memory and information disclosure risks. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-115386 because it affects Wasmtime deployments using wasmtime-wasi, potentially leading to information disclosure or guest memory corruption. The vulnerability requires verification of exposure and assessment of mitigation needs.

• Potential information disclosure due to uninitialized memory exposure
• Possible guest memory corruption or unexpected behavior

Technical summary

The vulnerability occurs in the fd_readdir function, which copies uninitialized struct padding into guest memory. This issue affects the wasmtime-wasi package. Defenders should prioritize verifying exposure in Wasmtime deployments, especially those using wasmtime-wasi, and assess the need for updates or mitigations. The vulnerability requires verification of exposure and assessment of mitigation needs based on the provided version ranges and potential impacts on guest memory and information disclosure risks. The CVE record and source item provide limited information about the vulnerability, primarily referencing a Wasmtime security advisory and a RustSec database entry.

Defensive priority

Defenders should prioritize verifying exposure in Wasmtime deployments, especially those using wasmtime-wasi, and assess the need for updates or mitigations.

Recommended defensive actions

• Verify exposure in Wasmtime deployments using wasmtime-wasi
• Assess the need for updates or mitigations based on the provided version ranges
• Monitor for potential issues with guest memory
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide limited information about the vulnerability, primarily referencing a Wasmtime security advisory and a RustSec database entry. The vulnerability requires verification of exposure and assessment of mitigation needs. Defenders should care about CVE-2026-115386 because it affects Wasmtime deployments using wasmtime-wasi, potentially leading to information disclosure or guest memory corruption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.