Read the docs
TI-2026-79466 Aliases CVE-2026-115381GHSA-m3j5-9cx2-7c68

Unbounded memory allocation in Wasmtime SinkOutputStream write-zeroes

Priority LOW 26CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Wasmtime before 36.0.17, from 37.0.0 before 48.0.4, and from 49.0.0 before 49.0.2 contains an unbounded memory allocation (CWE-770) in the WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout or stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed wasmtime (bytecodealliance): 36.0.17, 48.0.4, 49.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtimebefore 36.0.17; 37.0.0 to before 48.0.4; 49.0.0 to before 49.0.236.0.17, 48.0.4, 49.0.2Patch availableCNA
  • wasmtime Vendorbytecodealliance Affected before 36.0.17; 37.0.0 to before 48.0.4; 49.0.0 to before 49.0.2 Fixed in 36.0.17, 48.0.4, 49.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*——bytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Update Wasmtime to 36.0.17 on the 36 line, 48.0.4 on the 37 to 48 line, or 49.0.2 on the 49 line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 36.0.17, 48.0.4, 49.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    bytecodealliance wasmtime 36.0.17, 48.0.4, 49.0.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-79465 Resource exhaustion in Wasmtime WASI poll_oneoff ignores fuel limitsPriority LOW 22
    • TI-2026-79471 Wasmtime fd_readdir discloses uninitialized host memory to guestsPriority LOW 11
    Show all 3 records →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115381
  2. 2026-10-22 Alias added: GHSA-m3j5-9cx2-7c68
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-26 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences