Read the docs
TI-2026-79470 Aliases CVE-2026-115385GHSA-c8j4-4v4r-vm84

Host panic in Wasmtime WASIp3 timestamp handling

Priority LOW 29CWE-754Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Wasmtime from 46.0.0 before 48.0.4 and from 49.0.0 before 49.0.2 has a denial of service flaw in the wasmtime-wasi WASIp3 implementation. An improper check for unusual or exceptional conditions (CWE-754) lets a guest with mutable preopened directory access call set-times or set-times-at with negative seconds timestamps before the epoch, which triggers an assertion failure. The failure aborts the Unix host process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00112 1st percentileScored 2026-11-07
Fix Fixed wasmtime (bytecodealliance): 48.0.4, 49.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytecodealliancewasmtime46.0.0 to before 48.0.4; 49.0.0 to before 49.0.248.0.4, 49.0.2Patch availableCNA
  • wasmtime Vendorbytecodealliance Affected 46.0.0 to before 48.0.4; 49.0.0 to before 49.0.2 Fixed in 48.0.4, 49.0.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:*——bytecodealliance
  • cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:*:*:* Versions — — ·bytecodealliance

Remediation

Upgrade Wasmtime to version 48.0.4 or 49.0.2. Users on the 46.0.0 line must move to 48.0.4 or later, since 46.0.0 is affected before 48.0.4.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA wasmtime (bytecodealliance) Fixed in 48.0.4, 49.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    bytecodealliance wasmtime 48.0.4, 49.0.2

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-79469 Stack buffer overflow in Wasmtime async callbacksPriority MEDIUM 42
    • TI-2026-79464 Missing GC rooting in Wasmtime try_call corrupts GC heapPriority LOW 30
    • TI-2026-79468 Wasmtime tag import validation flaw corrupts GC heapPriority LOW 26
    Show all 5 records →

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-115385
  2. 2026-10-22 Alias added: GHSA-c8j4-4v4r-vm84
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-26 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-85541 WAMR fast interpreter loader heap overflow via constant deduplication mismatch CVSS 4.0HIGH 8.8
  • TI-2024-16741 An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit… CVSS 3.1HIGH 8.8
  • TI-2024-22658 An out-of-bound memory read vulnerability was discovered in Bytecode Alliance… CVSS 3.1HIGH 7.5
  • TI-2024-18300 wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL… CVSS 3.1HIGH 7.5
  • TI-2023-26034 An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime… CVSS 3.1HIGH 7.5
  • TI-2025-33969 WebAssembly Micro Runtime's `--addr-pool` option allows all IPv4 addresses when subnet mask is not specified CVSS 4.0MEDIUM 6.9
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences