Sandbox Escape Vulnerability in Wasmtime by Bytecode Alliance
CVE-2026-115392

8.8HIGH

Key Information:

Vendor

Bytecodealliance

Status
Wasmtime
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115392?

A vulnerability in Wasmtime versions prior to 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows attackers to escape the filesystem sandbox. This occurs due to the mishandling of symlinks with trailing slashes in the cap-std dependency on macOS and specific Linux kernels that lack the openat2 function. Consequently, any guest with write access to a sandboxed directory can gain unauthorized access to host-accessible files, while read-only guests can exploit preexisting symlinks to read host files.

Affected Version(s)

wasmtime 0 < 24.0.13

wasmtime 25.0.0 < 36.0.14

wasmtime 37.0.0 < 46.0.3

References

https://github.com/bytecodealliance/wasmtime/security/adv...
vendor-advisory
https://www.vulncheck.com/advisories/wasmtime-before-24.0...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.