CVE-2026-115386

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 2,6
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.

908

Use of Uninitialized Resource

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability
Potential Impacts:
Read Memory Read Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/bytecodealliance/wasmtime/security/advis…
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r…
https://www.vulncheck.com/advisories/wasmtime-before-36.0.1…
https://www.vulncheck.com/advisories/wasmtime-before-36.0.17-37.0.0-before-48.0…