---
cve: "CVE-2026-115385"
severity: "MEDIUM"
cvss: 6.9
epss: "0.1%"
vendor: "bytecodealliance"
kev: false
exploited: false
published: "2026-10-22 19:17:45"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-02T20:48:07+01:00"
---

# CVE-2026-115385

> 6.9 MEDIUM · 🧪 PoC

## Beschreibung

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access can call set-times or set-times-at with negative seconds timestamps before the epoch, triggering an assertion failure that crashes the host.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-26 19:38:29
- CNA-CVSS: **6.9** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-754** — Improper Check for Unusual or Exceptional Conditions
  The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

## Patch verfügbar (OSV)

- d02ffd202850007ea953224f589a569e8830eb6c (Commit)
- 3c8a3e79aa3188a1a12b3aebbaa097abccceac92 (Commit)

## Referenzen

- <https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc>
- <https://www.vulncheck.com/advisories/wasmtime-46.0.0-before-48.0.4-and-49.0.0-before-49.0.2-host-panic-via-wasip3-timestamps>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-115385/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_