CVE-2026-54786: CWE-772: Missing Release of Resource after Effective Lifetime in bytecodealliance wasmtime
Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. In a loop, guests can use fd_renumber to cause hosts to exhaust both resources and file descriptors. This bug only affects the native implementation of WASIp1, meaning that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected. This issue has been fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.
AI Analysis
Technical Summary
Wasmtime versions prior to 24.0.10; 25.0.0 through before 36.0.11; 37.0.0 through before 44.0.3; and 45.0.0 and 45.0.1 contain a native WASIp1 implementation with a resource leak in fd_renumber. The function updates the guest's descriptor table but fails to close the underlying host file descriptor, leaking resources until the Store is destroyed. This can lead to exhaustion of host resources and file descriptors if exploited in a loop. Only runtimes exposing fd_renumber and file descriptor acquisition are affected. The issue is fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.
Potential Impact
The vulnerability causes a resource leak on the host system by not properly closing file descriptors during renumbering, potentially leading to exhaustion of host resources and file descriptors. This can degrade host system stability or cause denial of service conditions. The impact is limited to affected wasmtime runtimes that expose fd_renumber and allow file descriptor acquisition. The CVSS score is low (2.3), reflecting limited severity and complexity of exploitation.
Mitigation Recommendations
This issue has been fixed in wasmtime versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2. Users should upgrade to one of these fixed versions or later. There is no vendor advisory indicating alternative mitigations or that no action is required. If upgrading is not immediately possible, limiting or denying guest access to file descriptors can prevent exploitation.
CVE-2026-54786: CWE-772: Missing Release of Resource after Effective Lifetime in bytecodealliance wasmtime
Description
Wasmtime is a runtime for WebAssembly. All versions prior to 24.0.10; versions 25.0.0 through those before 36.0.11; versions 37.0.0 through those before 44.0.3; and versions 45.0.0 and 45.0.1 contain a native implementation of WASIp1 which suffers from a leak in the fd_renumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while fd_renumber works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corresponding Store is destroyed. In a loop, guests can use fd_renumber to cause hosts to exhaust both resources and file descriptors. This bug only affects the native implementation of WASIp1, meaning that only runtimes which load core wasm modules and expose fd_renumber are affected. Runtimes are additionally only affected if they expose the ability to acquire a file descriptor, such as opening a file. For runtimes that deny access to files they are unaffected. This issue has been fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.
CVSS v4.0
Score 2.3low
Affected software
pkg:github/bytecodealliance/wasmtimeRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Wasmtime versions prior to 24.0.10; 25.0.0 through before 36.0.11; 37.0.0 through before 44.0.3; and 45.0.0 and 45.0.1 contain a native WASIp1 implementation with a resource leak in fd_renumber. The function updates the guest's descriptor table but fails to close the underlying host file descriptor, leaking resources until the Store is destroyed. This can lead to exhaustion of host resources and file descriptors if exploited in a loop. Only runtimes exposing fd_renumber and file descriptor acquisition are affected. The issue is fixed in versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2.
Potential Impact
The vulnerability causes a resource leak on the host system by not properly closing file descriptors during renumbering, potentially leading to exhaustion of host resources and file descriptors. This can degrade host system stability or cause denial of service conditions. The impact is limited to affected wasmtime runtimes that expose fd_renumber and allow file descriptor acquisition. The CVSS score is low (2.3), reflecting limited severity and complexity of exploitation.
Mitigation Recommendations
This issue has been fixed in wasmtime versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2. Users should upgrade to one of these fixed versions or later. There is no vendor advisory indicating alternative mitigations or that no action is required. If upgrading is not immediately possible, limiting or denying guest access to file descriptors can prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T23:23:57.714Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a457a6627e9c7971919753b
Added to database: 07/01/2026, 20:36:54 UTC
Last enriched: 07/09/2026, 09:23:11 UTC
Last updated: 08/15/2026, 00:41:13 UTC
Views: 132
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.