Uninitialized Memory Exposure in Wasmtime-WASI: fd_readdir Vulnerability
Summary
RUSTSEC-2026-0323: fd_readdir copies uninitialized struct padding into guest memory. Affects wasmtime-wasi across 3 version ranges.
>= 0.0.0-0, < 36.0.17
>= 37.0.0, < 48.0.4
>= 49.0.0, < 49.0.2
Fixed in 36.0.17, 48.0.4 or 49.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wasmtime-WASI is a Rust library that provides a WebAssembly runtime for executing WASI (WebAssembly System Interface) applications. It allows developers to run WebAssembly modules with access to system resources. The library is designed for performance and safety, but like any software, it can have vulnerabilities that may expose sensitive data or lead to unexpected behavior. This specific vulnerability arises from the handling of uninitialized memory, which can lead to security risks when guest memory is accessed.
Vulnerability Detail
The vulnerability identified in Wasmtime-WASI involves the fd_readdir function, which copies uninitialized struct padding into guest memory. This can lead to the exposure of sensitive information that resides in memory, potentially allowing an attacker to read arbitrary data. The issue originates from improper memory handling, where uninitialized data is inadvertently shared with the guest environment. This can have serious implications, especially in multi-tenant environments where isolation is critical.
How To Fix
Latest published version: 50.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.0.0-0, < 36.0.1736.0.17 -
>= 37.0.0, < 48.0.448.0.4 -
>= 49.0.0, < 49.0.249.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the fd_readdir function until you can update to a patched version. If you must use it, ensure that your application does not expose sensitive data through guest memory.
Conclusion
The fd_readdir vulnerability in Wasmtime-WASI poses a risk of exposing uninitialized memory to guest applications. It is crucial to update to a patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for wasmtime-wasi →
FAQ
The CVSS score of this vulnerability is 4.0, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The potential consequences include unauthorized access to sensitive data, which could lead to data breaches or exploitation by attackers.
Yes, versions 36.0.17, 48.0.4, and 49.0.2 have been patched to fix this vulnerability.
If you cannot update immediately, avoid using the fd_readdir function and ensure that your application does not expose sensitive data through guest memory.
References
Related vulnerabilities
Recent vulnerabilities recorded for wasmtime-wasi.
