Information Disclosure in Wasmtime by Bytecode Alliance

CVE-2026-115386

What is CVE-2026-115386?

An information disclosure vulnerability exists in the fd_readdir implementation of Wasmtime. This issue affects versions prior to 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2. It enables guests with a preopened directory to potentially list directory entries, inadvertently exposing three bytes of leftover memory from the host stack or heap associated with each directory entry. This could lead to unintentional information leakage and must be addressed to ensure data security and memory integrity.

References