Read the docs
TI-2024-34661 Aliases CVE-2024-51756GHSA-hxf5-99xg-86hw

cap-std doesn't fully sandbox all the Windows device filenames

Priority LOW 13CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted filesystem paths could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them provide access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. The bug is fixed in #371, which is published in cap-primitives 3.4.1, cap-std 3.4.1, and cap-async-std 3.4.1. There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00583 48th percentileScored 2026-11-07
Fix Fixed cap-std (bytecodealliance): 3.4.1cap-std (crates.io): 3.4.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancecap-stdbefore 3.4.13.4.1Patch availableCNA
—cap-std (crates.io)before 3.4.13.4.1Patch availableGHSA-hxf5-99xg-86hw
—cap-async-std (crates.io)before 3.4.13.4.1Patch availableGHSA-hxf5-99xg-86hw
—cap-primitives (crates.io)before 3.4.13.4.1Patch availableGHSA-hxf5-99xg-86hw
  • cap-std Vendorbytecodealliance Affected before 3.4.1 Fixed in 3.4.1 Patch available CNA
  • cap-std (crates.io) Vendor— Affected before 3.4.1 Fixed in 3.4.1 Patch available GHSA-hxf5-99xg-86hw
  • cap-async-std (crates.io) Vendor— Affected before 3.4.1 Fixed in 3.4.1 Patch available GHSA-hxf5-99xg-86hw
  • cap-primitives (crates.io) Vendor— Affected before 3.4.1 Fixed in 3.4.1 Patch available GHSA-hxf5-99xg-86hw

Remediation

  • Fix · CNA cap-std (bytecodealliance) Fixed in 3.4.1
  • Fix · GHSA-hxf5-99xg-86hw cap-std (crates.io) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-hxf5-99xg-86hw cap-async-std (crates.io) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-hxf5-99xg-86hw cap-primitives (crates.io) Fixed in 3.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-51756
  2. 2026-10-03 Alias added: GHSA-hxf5-99xg-86hw

References

Advisory 1

Other 7

  • TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences