CVE-2026-54786: Bytecode Alliance Wasmtime resource leak in WASIp1 fd_renumber

CVE-2026-54786 · Severity: medium · CVSS 5 · Published 2026-07-01

Wasmtime is a WebAssembly runtime that executes untrusted code. A flaw in its WASI (WebAssembly System Interface) file descriptor handling allows malicious code to repeatedly renumber file descriptors without properly cleaning up host resources, causing the host process to exhaust available file descriptors and system memory. Affected hosts must run untrusted WebAssembly code with file I/O permissions to be vulnerable.

Technologies: wasmtime-wasi (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-54786 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54786 being exploited in the wild.
How severe is CVE-2026-54786?
Medium severity, with a CVSS score of 5, published 1 July 2026.
Which products and versions are affected?
wasmtime-wasi (crates.io) SEMVER:introduced=0,fixed=24.0.10, SEMVER:introduced=0.0.0-0,fixed=24.0.10,introduced=25.0.0,fixed=36.0.11,introduced=37.0.0,fixed=44.0.3,introduced=45.0.0,fixed=45.0.2.
Is there a fix for CVE-2026-54786?
Yes. wasmtime-wasi (crates.io): upgrade to 24.0.10, 45.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54786 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54786?
Check whether you run wasmtime-wasi (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • wasmtime-wasi (crates.io): upgrade to 24.0.10, 45.0.2 or later
    cargo update -p wasmtime-wasi

Technical details

Wasmtime's native implementation of WASIp1 contains a resource leak in the `fd_renumber` function (CWE-400: Uncontrolled Resource Consumption). When a WebAssembly guest renames a file descriptor, the implementation updates only the guest-side descriptor table while failing to clean up the underlying host file descriptor. Over repeated calls in a loop, a malicious guest can exhaust host file descriptors and other resources without triggering cleanup until the entire Store is destroyed. The vulnerability requires three conditions: the host must load and execute a WebAssembly core module exposing `fd_renumber`, expose the ability to acquire file descriptors (e.g., file open), and allow untrusted guest code execution. Patches are available in Wasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2.

Affected products

  • Bytecode Alliance wasmtime-wasi < 24.0.10, >= 25.0.0 and < 36.0.11, >= 37.0.0 and < 44.0.3, >= 45.0.0 and < 45.0.2

Identifiers

  • CVE-2026-54786
  • GHSA-3p27-qvp9-27qf
  • RUSTSEC-2026-0182

Timeline

  • 2026-06-15: disclosed: GHSA advisory published
  • 2026-06-15: patched: Wasmtime 24.0.10, 36.0.11, 44.0.3, and 45.0.2 released with fix
  • 2026-08-26: advisory: GitHub Advisory Database updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.