Read the docs
TI-2026-39592 Aliases CVE-2026-54786GHSA-3p27-qvp9-27qf

Wasmtime: Leak in WASIp1 `fd_renumber` implementation

Priority LOW 12CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. In a loop, guests can use fd_renumber to cause hosts to exhaust both resources and file descriptors. This bug only affects the native implementation of WASIp1, meaning that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected. This issue has been fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Partial wasmtime (bytecodealliance): 24.0.10, 36.0.11, 44.0.3 +1wasmtime-wasi (crates.io): 24.0.10, 45.0.2, 36.0.11 +1Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtimebefore 24.0.10; 25.0.0 to before 36.0.11; 37.0.0 to before 44.0.3; 45.0.0 to before 45.0.224.0.10, 36.0.11, 44.0.3, 45.0.2Patch availableCNA
—wasmtime-wasi (crates.io)before 24.0.1024.0.10Patch availableGHSA-3p27-qvp9-27qf
—wasmtime-wasi (crates.io)45.0.0 to before 45.0.245.0.2Patch availableGHSA-3p27-qvp9-27qf
—wasmtime-wasi (crates.io)25.0.0 to before 36.0.1136.0.11Patch availableGHSA-3p27-qvp9-27qf
—wasmtime-wasi (crates.io)37.0.0 to before 44.0.344.0.3Patch availableGHSA-3p27-qvp9-27qf
  • wasmtime Vendorbytecodealliance Affected before 24.0.10; 25.0.0 to before 36.0.11; 37.0.0 to before 44.0.3; 45.0.0 to before 45.0.2 Fixed in 24.0.10, 36.0.11, 44.0.3, 45.0.2 Patch available CNA
  • wasmtime-wasi (crates.io) Vendor— Affected before 24.0.10 Fixed in 24.0.10 Patch available GHSA-3p27-qvp9-27qf
  • wasmtime-wasi (crates.io) Vendor— Affected 45.0.0 to before 45.0.2 Fixed in 45.0.2 Patch available GHSA-3p27-qvp9-27qf
  • wasmtime-wasi (crates.io) Vendor— Affected 25.0.0 to before 36.0.11 Fixed in 36.0.11 Patch available GHSA-3p27-qvp9-27qf
  • wasmtime-wasi (crates.io) Vendor— Affected 37.0.0 to before 44.0.3 Fixed in 44.0.3 Patch available GHSA-3p27-qvp9-27qf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*before 24.0.10; 25.0.0 to before 36.0.11; 37.0.0 to before 44.0.3; 45.0.0 to before 45.0.2Vulnerablebytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:* Versions before 24.0.10; 25.0.0 to before 36.0.11; 37.0.0 to before 44.0.3; 45.0.0 to before 45.0.2 Vulnerable ·bytecodealliance

Remediation

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 24.0.10, 36.0.11, 44.0.3, 45.0.2
  • Fix · GHSA-3p27-qvp9-27qf wasmtime-wasi (crates.io) Fixed in 24.0.10 Advisory →
  • Fix · GHSA-3p27-qvp9-27qf wasmtime-wasi (crates.io) Fixed in 45.0.2 Advisory →
  • Fix · GHSA-3p27-qvp9-27qf wasmtime-wasi (crates.io) Fixed in 36.0.11 Advisory →
  • Fix · GHSA-3p27-qvp9-27qf wasmtime-wasi (crates.io) Fixed in 44.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Connectivity Link 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54786
  2. 2026-10-03 Alias added: GHSA-3p27-qvp9-27qf

References

Advisory 2

Other 12

  • TI-2026-21632 Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future CVSS 4.0MEDIUM 6.9
  • TI-2023-11636 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime CVSS 3.1CRITICAL 10.0
  • TI-2022-18765 Wasmtime vulnerable to data leakage between instances in the pooling allocator CVSS 3.1HIGH 8.6
  • TI-2022-08604 Use after free in Wasmtime CVSS 3.1CRITICAL 9.8
  • TI-2022-18766 wasmtime_trap_code C API function has out of bounds write vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-27209 Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVSS 4.0CRITICAL 9.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences