CVE-2026-54786: Host File Descriptor Exhaustion in Wasmtime WASIp1 Runtime
Vulnerability ID: CVE-2026-54786
CVSS Score: 5.0
Published: 2026-08-26
A resource leak vulnerability in Wasmtime's WASIp1 native implementation of the fd_renumber system call allows guest WebAssembly applications to leak host file descriptors, ultimately leading to process-wide Denial of Service (DoS) via resource exhaustion.
TL;DR
Wasmtime failed to close the underlying host-level file descriptor when overwriting an active virtual descriptor via the WASIp1 fd_renumber system call, allowing malicious guests to exhaust host file descriptors and crash the process.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-400, CWE-772
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 5.0 (Medium)
- EPSS Score: 0.00367 (Percentile: 29.50%)
- Impact: Denial of Service (Host File Descriptor Exhaustion)
- Exploit Status: Proof-of-Concept / Regression Loop Test
- CISA KEV Status: Not Listed
Affected Systems
- Wasmtime (Bytecode Alliance) Runtime
-
Wasmtime: < 24.0.10 (Fixed in:
24.0.10) -
Wasmtime: >= 25.0.0, < 36.0.11 (Fixed in:
36.0.11) -
Wasmtime: >= 37.0.0, < 44.0.3 (Fixed in:
44.0.3) -
Wasmtime: >= 45.0.0, < 45.0.2 (Fixed in:
45.0.2)
Code Analysis
Commit: e9fbe97
Fix host file descriptor leak in WASIp1 fd_renumber implementation by closing the target descriptor prior to remapping.
Commit: 100bfe2
Backport fix for WASIp1 fd_renumber leak to v44 branch.
Commit: 36b305d
Backport fix for WASIp1 fd_renumber leak to v36 branch.
Exploit Details
- GitHub Security Advisory: Official advisory with detailed vulnerability breakdown and fix releases.
Mitigation Strategies
- Upgrade Wasmtime runtime to patched versions.
- Restrict guest module file system permissions to deny file creation and preopens.
- Monitor host file descriptor limits using standard system tooling (e.g. procfs).
Remediation Steps:
- Verify current Wasmtime dependencies in Cargo.toml.
- Update Wasmtime to 24.0.10, 36.0.11, 44.0.3, or 45.0.2 depending on active release line.
- Deploy updated host binary to production.
- Confirm configuration restricts preopens to read-only or empty configurations where possible.
References
Read the full report for CVE-2026-54786 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)