CVE-2026-115381

Wasmtime versions before 36.0.17 , 37.0.0 before 48.0.4 , and 49.0.0 before 49.0.2 are vulnerable to an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream . This component is the default stream used when stdout/stderr are not configured. A malicious We...