CVE-2026-47261 bytecodealliance CVE debrief

Who should care

Defenders responsible for Wasmtime deployments should assess exposure and prioritize upgrading to a fixed version. Defenders should review filesystem preopen permissions and monitor for potential exploitation attempts. Operators of affected systems should verify their current Wasmtime version and permissions.

Why it matters

CVE-2026-47261 is a high-severity vulnerability in Wasmtime, a WebAssembly runtime. It allows attackers to bypass access control mechanisms, potentially leading to unauthorized access or service disruption. Defenders should prioritize upgrading Wasmtime to a fixed version and review filesystem preopen permissions.

• Potential unauthorized access to sensitive data
• Possible disruption of service due to exploitation
• Need for verification of current Wasmtime version and permissions
• Requirement for monitoring and incident response planning

Technical summary

The vulnerability is caused by a missing assignment in the Dir::open_at function, which allows an attacker to bypass access control mechanisms. The affected versions of Wasmtime are prior to 24.0.9, 36.0.10, and 44.0.2. The vulnerability allows attackers to bypass access control mechanisms, potentially leading to unauthorized access or service disruption. Defenders should prioritize upgrading Wasmtime to a fixed version and review filesystem preopen permissions. The vulnerability has been fixed in versions 24.0.9, 36.0.10, and 44.0.2 of Wasmtime.

Defensive priority

Defenders should prioritize upgrading Wasmtime to a fixed version, specifically 24.0.9, 36.0.10, or 44.0.2, to mitigate this vulnerability.

Recommended defensive actions

• Upgrade Wasmtime to version 24.0.9, 36.0.10, or 44.0.2
• Review and adjust filesystem preopen permissions
• Monitor for potential exploitation attempts
• Verify current Wasmtime version and permissions
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The vulnerability is caused by a missing assignment in the Dir::open_at function, which allows an attacker to bypass access control mechanisms. The affected versions of Wasmtime are prior to 24.0.9, 36.0.10, and 44.0.2. The vulnerability allows attackers to bypass access control mechanisms, potentially leading to unauthorized access or service disruption. Defenders should prioritize upgrading Wasmtime to a fixed version and review filesystem preopen permissions. The vulnerability has been fixed in versions 24.0.9, 36.0.10, and 44.0.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.