LOW 5.0 GitHub
CVE-2026-54786
Wasmtime has a leak in WASIp1 `fd_renumber` implementation
### Impact
Wasmtime's native implementation of WASIp1 suffers from a leak in the `fd_renumber` function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while `fd_renumber` works correctly from a guest's perspective it ends up leaking resources in the host that aren't cleaned up until the corr
Affected Products
- rust/wasmtime-wasi < 24.0.10
- rust/wasmtime-wasi >= 45.0.0, < 45.0.2
- rust/wasmtime-wasi >= 25.0.0, < 36.0.11
- rust/wasmtime-wasi >= 37.0.0, < 44.0.3
References
- https://github.com/advisories/GHSA-3p27-qvp9-27qf
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf
- https://nvd.nist.gov/vuln/detail/CVE-2026-54786
- https://github.com/bytecodealliance/wasmtime/pull/13650
This low severity vulnerability with a CVSS score of 5.0 was published on 2026-08-26 via GitHub. Affected: rust/wasmtime-wasi < 24.0.10, rust/wasmtime-wasi >= 45.0.0, < 45.0.2, rust/wasmtime-wasi >= 25.0.0, < 36.0.11 and 1 more.
vulnfeed aggregates 11364 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.