CVE-2026-115386: Use of Uninitialized Resource in bytecodealliance wasmtime

The vulnerability in wasmtime affects versions >=0 <36.0.17, >=37.0.0 <48.0.4, and >=49.0.0 <49.0.2. It involves the WASIp1 fd_readdir function copying uninitialized struct padding into guest memory, leading to potential information disclosure. Specifically, guests with a preopened directory can list directory entries and receive three bytes of residual host memory per entry, which could leak sensitive data. The CVSS 4.0 vector indicates network attack vector, low complexity, partial attack complexity, low privileges required, partial user interaction, and low confidentiality impact.

The impact is limited to information disclosure of small amounts (three bytes per directory entry) of leftover host memory from stack or heap. This could potentially expose sensitive host memory contents to guest processes with preopened directories. The overall severity is low, reflecting the limited scope and difficulty of exploitation.

A fix is available in versions 36.0.17, 48.0.4, and 49.0.2 and later. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated.