CVE-2026-115387: Integer Overflow or Wraparound in bytecodealliance wasmtime

Wasmtime versions before 36.0.16, versions from 37.0.0 up to but excluding 48.0.3, and versions from 49.0.0 up to but excluding 49.0.1 contain a denial of service vulnerability in wasmtime-wasi. The vulnerability arises when guest WASI programs provide atim or mtim timestamp values whose sub-second fields overflow the seconds field to functions such as path_filestat_set_times, fd_filestat_set_times, set-times, or set-times-at. This overflow causes the host environment to panic and crash, resulting in denial of service.

An attacker controlling a guest WASI program can trigger a host crash by exploiting the integer overflow in filesystem timestamp handling. This results in denial of service against the host running wasmtime, potentially disrupting services relying on it. There is no indication of privilege escalation or code execution from the provided data.

Fixed versions are available: upgrade wasmtime to versions 36.0.16 or later if using the 0 to 36.0.16 range, 48.0.3 or later if using versions from 37.0.0 to 48.0.3, and 49.0.1 or later if using versions from 49.0.0 to 49.0.1. Applying these updates will remediate the vulnerability. No other mitigation guidance is provided.