crates.io/wasmtime-wasi CVE-2026-54786: medium 5, EPSS 0.37%

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Action: Upgrade wasmtime-wasi to 24.0.10 or later.

cargo update -p wasmtime-wasi --precise 24.0.10

cargo update -p wasmtime-wasi --precise 45.0.2

cargo update -p wasmtime-wasi --precise 36.0.11

cargo update -p wasmtime-wasi --precise 44.0.3

Affected

Fixed versions

Sources

• osv: GHSA-3p27-qvp9-27qf
• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf
• https://nvd.nist.gov/vuln/detail/CVE-2026-54786
• https://github.com/bytecodealliance/wasmtime/pull/13650
• https://github.com/bytecodealliance/wasmtime/commit/100bfe27253d2ce5154ddddf66d06e30f3fa6824
• https://github.com/bytecodealliance/wasmtime/commit/36b305d827149ac0336ddcbc0a378c303339d195
• https://github.com/bytecodealliance/wasmtime/commit/72493b11ed5df382c92a9dfb8b6bc064e471f1cd
• https://github.com/bytecodealliance/wasmtime/commit/e9fbe974c9698edef117323d981e13caf2097c13
• https://github.com/bytecodealliance/wasmtime/commit/f069f125cb77a4a3dced19a77d73790610678622
• https://github.com/bytecodealliance/wasmtime
• https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.10
• https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.11
• https://github.com/bytecodealliance/wasmtime/releases/tag/v44.0.3
• https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.2
• https://rustsec.org/advisories/RUSTSEC-2026-0182.html

CVE-2026-54786 · published 2026-08-26T14:30:10Z · modified 2026-08-26T14:45:10.469817244Z · JSON