CVE-2026-58494 bytecodealliance CVE debrief

Who should care

Defenders of systems using Wasmtime should prioritize patching to prevent potential file system manipulation. This includes operators managing Wasmtime deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Technical summary

The vulnerability, CVE-2026-58494, arises from wasmtime-wasi's hard-link creation and renaming checks not properly verifying FilePerms on source and destination preopens. This oversight enables a WASI guest to bypass intended file system restrictions, potentially leading to unauthorized file overwrites on the host system. The issue is addressed in Wasmtime versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1 through improved permission checks.

Defensive priority

Medium priority due to the potential for file system manipulation and the availability of patches.

Recommended defensive actions

• Apply patches (versions 24.0.11, 36.0.12, 45.0.3, 46.0.1) to Wasmtime installations.
• Review and restrict WASI guest capabilities, especially those involving file system interactions.
• Monitor for unusual file system activities that could indicate exploitation attempts.
• Conduct a thorough review of current Wasmtime deployments to identify potential exposure.
• Inventory assets that may be impacted and prioritize patching based on criticality.
• Implement compensating controls such as enhanced monitoring and access restrictions for high-risk systems.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. GitHub commits and release tags offer technical details on the fixes. Evidence is limited to public sources and may not cover all affected systems or potential impacts. Defenders should verify system exposure and review vendor guidance for specific patching and mitigation steps.

Official resources