CVE-2026-58494: bytecodealliance wasmtime Improper Preservation of Permissions
Vulnerability summary
CVE-2026-58494 is a medium (CVSS 6.5) Improper Preservation of Permissions vulnerability in bytecodealliance wasmtime. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.
Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 09-07-2026Last modifiedVulnerability information updated.
Description
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · Crates.ioEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Bytecodealliance1 product
- wasmtime< 24.0.11 | ≥ 25.0.0, < 36.0.12 | ≥ 37.0.0, < 45.0.3 | ≥ 46.0.0, < 46.0.1
Chainguard1 product
- wizerAll versions (No fix recorded)
Crates.Io1 product
- wasmtime-wasi< 24.0.11 | ≥ 25.0.0, < 36.0.12 | ≥ 37.0.0, < 45.0.3 | ≥ 46.0.0, < 46.0.1
Debian1 product
- rust-wasmtimeAll versions (No fix recorded) | < 36.0.12+dfsg-1
Ubuntu1 product
- rust-wasmtimeAll versions (No fix recorded)
Wolfi1 product
- wizerAll versions (No fix recorded)
6 vendors · 6 products
References
17 links- github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmjX Refsource CONFIRMREPORTWEB
- github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0cX Refsource MISCREPORTWEB
- github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367X Refsource MISCREPORTWEB
- github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcdX Refsource MISCREPORTWEB
- github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9eX Refsource MISCREPORTWEB
