CVE-2026-115386
Low · 2.6CVSS
2.6
EPSS
0.2%
Published
Oct 22, 2026
CISA due date
—
The record
Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preopened directory can list entries to receive three bytes of leftover host stack or heap memory per directory entry.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119602 libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in… CWE-908
- CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allows… CWE-908
- CVE-2026-116739 VMime through 0.9.2 contains an information disclosure vulnerability in the… CWE-908
- CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. CWE-908
- CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver… CWE-908
- CVE-2026-114501 Pillow is a Python imaging library. CWE-908
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-96206 Use of uninitialized resource in Windows Subsystem for Linux allows an authorized… CWE-908