CVE-2026-54786

Analyzed Analyzed - Analysis Complete

File Descriptor Leak in Wasmtime WASIp1

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: GitHub, Inc.

Description

Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. In a loop, guests can use fd_renumber to cause hosts to exhaust both resources and file descriptors. This bug only affects the native implementation of WASIp1, meaning that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected. This issue has been fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-02

Generated

2026-07-22

AI Q&A

2026-07-02

EPSS Evaluated

2026-07-20

NVD

CVE-2026-54786

Affected Vendors & Products

Vendor	Product	Version / Range
bytecodealliance	wasmtime	to 24.0.10 (exc)
bytecodealliance	wasmtime	From 25.0.0 (inc) to 36.0.11 (exc)
bytecodealliance	wasmtime	From 37.0.0 (inc) to 44.0.3 (exc)
bytecodealliance	wasmtime	From 45.0.0 (inc) to 45.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Wasmtime, a runtime for WebAssembly, specifically in its native implementation of WASIp1. The issue is in the fd_renumber function, where the file descriptor being renumbered is not properly closed on the host side. While the guest's descriptor table is updated correctly, the host's underlying descriptor table is not, causing resource leaks. This means that resources and file descriptors on the host are not cleaned up until the corresponding Store is destroyed.

If a guest repeatedly uses fd_renumber in a loop, it can cause the host to exhaust its available resources and file descriptors. However, this vulnerability only affects runtimes that load core wasm modules, expose fd_renumber, and allow acquiring file descriptors (e.g., opening files). Runtimes that deny file access are not affected.

The issue has been fixed in Wasmtime versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.

Detection Guidance

There are no specific detection commands or network indicators provided for this vulnerability. The issue is a resource leak in Wasmtime's native implementation of WASIp1's fd_renumber function, which leads to exhaustion of host resources and file descriptors when exploited.

Detection would likely involve monitoring the Wasmtime runtime for abnormal resource or file descriptor usage, especially if running vulnerable versions prior to 24.0.10, between 25.0.0 and before 36.0.11, between 37.0.0 and before 44.0.3, or versions 45.0.0 and 45.0.1.

Since the vulnerability manifests as leaked file descriptors, system administrators can monitor open file descriptors for the Wasmtime process using commands such as:

lsof -p <wasmtime_process_id> # Lists open files for the Wasmtime process
watch -n 1 'lsof -p <wasmtime_process_id> | wc -l' # Continuously monitor the number of open file descriptors
cat /proc/<wasmtime_process_id>/fd | wc -l # Count open file descriptors

A steadily increasing number of open file descriptors without corresponding closures may indicate exploitation of this vulnerability.

However, no direct detection commands or signatures are provided in the available information.

Impact Analysis

This vulnerability can lead to resource exhaustion on the host system running Wasmtime. Specifically, if exploited, it can cause the host to run out of file descriptors and other resources due to leaked descriptors that are not properly closed.

Such resource exhaustion can degrade system performance, cause failures in opening new files or network connections, and potentially lead to denial of service conditions on the host.

Compliance Impact

The vulnerability in Wasmtime's native implementation of WASIp1's fd_renumber function primarily causes a resource leak that can lead to exhaustion of host resources and file descriptors, impacting system availability.

There is no information provided in the available resources about any direct impact on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, update Wasmtime to a fixed version. The issue has been resolved in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.

Additionally, if your runtime denies access to files or does not expose the ability to acquire file descriptors, it is not affected by this vulnerability.

Hi! I’m here to help you understand CVE-2026-54786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70