CVE-2026-115387 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments, particularly in environments processing guest-provided data, should assess exposure and apply patches. This includes operators, platform administrators, and security teams who manage Wasmtime installations. Additionally, defenders should review data handling and ensure proper input validation to mitigate potential impacts. The vulnerability can lead to host instability or panic, and defenders should take a a

Why it matters

CVE-2026-115387 is a vulnerability in Wasmtime that allows a guest to panic the host. Defenders should assess exposure, apply patches, and review data handling to mitigate potential impacts.

• Potential for host panic or instability
• Need for patching or updating Wasmtime installations
• Importance of reviewing guest-provided data handling

Technical summary

The vulnerability allows a guest to panic the host through a filesystem datetime overflow in Wasmtime. Affected versions of wasmtime-wasi have been identified, and patches have been released. The vulnerability is caused by an integer overflow when handling file system timestamps, which can lead to a host panic. Defenders should assess exposure and apply patches to mitigate the vulnerability. The vulnerability has been addressed in various versions of the wasmtime-wasi package, and defenders should review data handling to ensure proper input validation.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for Wasmtime installations, particularly in environments where guest-provided data is processed.

Recommended defensive actions

• Assess exposure of Wasmtime installations to this vulnerability
• Apply patches or updates to affected versions of wasmtime-wasi
• Review and update inventory of Wasmtime deployments
• Verify the integrity of guest-provided data
• Implement compensating controls for exposed systems
• Monitor relevant logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The advisory provides details on the vulnerability, including affected versions and fixed versions. However, specific details about exploitation are limited. The vulnerability is tracked as CVE-2026-115387 and is related to a GitHub security advisory (GHSA-j2g9-4prp-pf6h). Defenders should verify the affected versions of wasmtime-wasi and apply patches to mitigate the vulnerability. Evidence is based on the official CVE Program record and the RustSec advisory for RUSTSEC-2026-0314.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.