CVE-2026-54786

[CVE catalog]

Severity

Medium · CVSS 5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Published

Jul 1, 2026, 8:12:35 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 25, 2026

A flaw was found in Wasmtime, a runtime for WebAssembly. Its native implementation of WASIp1, a system interface for WebAssembly, contains a resource leak in the fd_renumber function. A malicious guest program can repeatedly call this function, causing the host system to exhaust its file descriptors (system resources used to access files or other input/output sources) and other resources. This can lead to a Denial of Service (DoS), making the system unavailable. Wasmtime: Wasmtime: Leak in WASIp1 `fd_renumber` implementation This flaw is rated as Low impact. Wasmtime's WASIp1 implementation can leak file descriptors when renumbering, allowing a malicious guest program to exhaust host resources and cause a Denial of Service. This issue primarily affects Red Hat products that utilize Wasmtime with WASIp1 enabled and allow guest programs to acquire file descriptors.