EUVD-2026-42393

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination...

SUSE CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

CVE-2026-58494

A flaw was found in Wasmtime, a runtime for WebAssembly. A WebAssembly System Interface WASI guest with a read-only source file capability can exploit this vulnerability. During hard-link creation and renaming operations, the system checks directory permissions but fails to match file permissions...

CVE-2026-58494

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite...

PT-2026-56584

Name of the Vulnerable Software and Affected Versions Wasmtime versions prior to 24.0.11 Wasmtime versions prior to 36.0.12 Wasmtime versions prior to 45.0.3 Wasmtime versions prior to 46.0.1 Description In the wasmtime-wasi component, hard-link creation and renaming processes verify directory...