CVE-2026-115386 in Wasmtime
Summary
by MITRE • 10/23/2026
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified security flaw resides within the WebAssembly System Interface (WASI) implementation, specifically affecting the fd_readdir function in Wasmtime versions prior to 36.0.17, 37.0.0 through 48.0.4, and 49.0.0 through 49.0.2. This vulnerability is classified as an information disclosure issue where uninitialized memory structures are inadvertently exposed to the guest environment. The root cause lies in how the host system handles struct padding during the serialization of directory entry data for transmission to the WebAssembly sandbox. In C and many other systems programming languages, structs often contain padding bytes inserted by the compiler to align fields according to architecture-specific requirements. When these structures are copied into memory buffers without proper initialization or explicit zeroing of unused space, residual data from previous operations remains in those padding regions.
During the execution of fd_readdir, which is responsible for reading directory entries and returning them as a stream of records, Wasmtime constructs host-side structs to represent each entry before copying their contents into guest memory via WASI interfaces. Due to the oversight in handling struct padding, three bytes per directory entry contain uninitialized data from the host stack or heap. This means that every time a WebAssembly module requests a listing of files within a preopened directory, it receives not only the intended file metadata such as names and types but also fragments of sensitive memory content from the host process. These leaked bytes can potentially include pointers, authentication tokens, cryptographic keys, or other confidential data depending on what was previously stored in those specific stack or heap locations at the time of the call.
The operational impact of this vulnerability is significant for applications relying on Wasmtime to isolate untrusted code within a sandboxed environment. While WebAssembly provides strong isolation guarantees regarding execution and memory access boundaries, this flaw creates a side-channel through which host state can leak into the guest space. An attacker controlling or influencing the behavior of a malicious WebAssembly module could exploit this by repeatedly invoking fd_readdir on accessible directories to systematically extract information about the host environment. This capability undermines the fundamental security model of sandboxing, as it allows an untrusted workload to gather intelligence that may facilitate further attacks such as buffer overflows, return-oriented programming exploits, or targeted data theft against other processes running on the same host system.
From a classification perspective, this vulnerability aligns with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and more specifically CWE-457: Use of Uninitialized Variable within the context of memory management errors. In terms of adversarial tactics, it supports reconnaissance activities under MITRE ATT&CK technique T1083: File and Directory Discovery, although the primary risk extends beyond mere discovery into broader information gathering that could aid in lateral movement or privilege escalation if combined with other vulnerabilities. The severity is generally considered moderate to high depending on the sensitivity of data present in the host memory at runtime and the trust level assigned to the WebAssembly modules being executed.
Mitigation strategies primarily involve upgrading Wasmtime to version 36.0.17, 48.0.4, or later for the respective release branches, as these versions contain patches that ensure proper initialization of struct padding fields before copying data into guest memory. Developers integrating older versions should consider implementing additional validation layers if immediate patching is not feasible, although such workarounds are less reliable than addressing the root cause in the runtime itself. Security auditors reviewing systems using affected Wasmtime releases should prioritize testing for information leakage through WASI interfaces and verify that all binary distributions have been updated to include these critical fixes. Continuous monitoring of host memory patterns during directory listing operations can also help detect anomalous data exposure indicative of this vulnerability being actively exploited in production environments.