CVE-2026-58494
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1, the wasmtime-wasi component checked directory permissions but not matching FilePerms on source and destination preopens during hard-link creation and renaming. This allowed a WASI guest with read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces.
Risk Assessment
The organization is at risk of unauthorized overwriting of host files that should be read-only, potentially leading to data integrity breaches and system compromise.
Recommendation
Immediately update Wasmtime to version 24.0.11, 36.0.12, 45.0.3, or 46.0.1, depending on the branch in use, to remediate the vulnerability.
Other vulnerabilities in Wasmtime
See all- CVE-2026-54786Medium
Wasmtime prior to versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2 contains a vulnerability in the native WASIp1 implementation where the fd_renumber function fails to properly close the target file descriptor. This causes resource leaks in the host system, potentially leading to exhaustion of file descriptors and resources.
- CVE-2026-47261High
Wasmtime, a runtime for WebAssembly, has a vulnerability in versions prior to 24.0.9, 36.0.10, and 44.0.2 that allows bypassing the access control mechanism using the wasip2 descriptor.open-at or wasip1 path_open interfaces. The issue arises from a missing assignment in the open mode handling, allowing files to be opened with the OpenFlags::TRUNCATE flag without the necessary write permissions.
- CVE-2026-44216High
Wasmtime versions 30.0.0 through 36.0.8, 43.0.2, and 44.0.1 contain a vulnerability where allocation logic for WebAssembly tables panics on overflow. This panic can be triggered when allocating extremely large tables (64-bit range via memory64 proposal). An attacker can cause a denial of service by providing a WebAssembly module or component that requests such a large table.
- CVE-2026-34971High
Wasmtime versions 32.0.0 through 36.0.7, 42.0.2, and 43.0.1 have a bug in the Cranelift compiler on aarch64 that miscalculates memory addresses during heap access. This allows WebAssembly modules to bypass bounds checks and access arbitrary host memory, resulting in a sandbox escape.
Original NVD description (English source)
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.