# CVE-2026-115385: Wasmtime denial of service in WASIp3 timestamp handling

Source: https://junglewise.ai/threats/cve-2026-115385-wasmtime-46-0-0-before-48-0-4-and-49-0-0-before-49-0-2-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115385 · Severity: medium · CVSS 6.2 · Published 2026-10-22

Wasmtime is a WebAssembly runtime that executes untrusted code in a sandboxed environment. A guest WebAssembly program with write access to the filesystem can crash the host process by calling timestamp operations with negative seconds values, causing a denial of service that stops the application.

Technologies: [Bytecode Alliance Wasmtime](https://junglewise.ai/threats/technologies/bytecode-alliance-wasmtime). Vendors: [Bytecode Alliance](https://junglewise.ai/threats/vendors/bytecode-alliance).

## Quick answers

**Is CVE-2026-115385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115385 being exploited in the wild.

**How severe is CVE-2026-115385?** Medium severity, with a CVSS score of 6.2, published 22 October 2026.

**Which products and versions are affected?** Bytecode Alliance Wasmtime 46.0.0 before 48.0.4; 49.0.0 before 49.0.2.

**Is there a fix for CVE-2026-115385?** Yes: fixed in 48.0.4, 49.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115385 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-115385?** Check whether you run Bytecode Alliance Wasmtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 48.0.4, 49.0.2

## Technical details

The WASIp3 implementation in wasmtime-wasi contains an assertion failure in the set-times and set-times-at filesystem methods when converting guest-supplied timestamps to system-specific representations. A guest with mutable preopened directory access can trigger this by passing negative seconds timestamps (representing times before the Unix epoch), causing the host process to panic. This only affects Unix hosts and WASIp3; WASIp1/WASIp2 and Windows are unaffected because their implementations either do not support pre-epoch timestamps or handle them correctly.

## Affected products

- Bytecode Alliance Wasmtime 46.0.0 before 48.0.4; 49.0.0 before 49.0.2

## Timeline

- 2026-10-02: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc)
- [https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-host-panic-via-wasip3-timestamps](https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-host-panic-via-wasip3-timestamps)

## Related threats

- [Wasmtime wasi-http response splitting via unvalidated headers](https://junglewise.ai/threats/cve-2026-121439-wasmtime-46-0-0-before-48-0-7-and-49-0-0-before-49-0-4-contains)
- [Wasmtime denial of service in component model stream operations](https://junglewise.ai/threats/cve-2026-119143-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime host panic in call_async Future drop](https://junglewise.ai/threats/cve-2026-119142-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime denial of service in realloc handling](https://junglewise.ai/threats/cve-2026-119141-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)
- [Wasmtime denial of service via thread.yield in component start](https://junglewise.ai/threats/cve-2026-119140-wasmtime-46-0-0-before-48-0-6-and-49-0-0-before-49-0-3-contains)