« Volver al listado

CVE-2026-58494

Estado: AplazadaMedia (6.5)—

Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bytecodealliance — WasmtimeAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-58494",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-58494",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-09T13:28:46.718754Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bytecodealliance",
          "product": "wasmtime",
          "versions": [
            {
              "status": "affected",
              "version": "< 24.0.11"
            },
            {
              "status": "affected",
              "version": ">= 25.0.0, < 36.0.12"
            },
            {
              "status": "affected",
              "version": ">= 37.0.0, < 45.0.3"
            },
            {
              "status": "affected",
              "version": ">= 46.0.0, < 46.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-08T21:16:54.000",
  "references": [
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/5ddfd5f1ef28f2041fa07d237ad0336e167b0e0c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/7db94cdcf0c79cb3dfde884b534b653f2dd83367",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/8a250aac0962ca1364b5f16525720e9d0b39edcd",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/commit/d3ceb56ec35f39e02496eeb4e2d9c7f4fb964d9e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v24.0.11",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v36.0.12",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v45.0.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/releases/tag/v46.0.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-281"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces. This issue is fixed in versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1."
    }
  ],
  "lastModified": "2026-07-10T19:10:59.333",
  "sourceIdentifier": "security-advisories@github.com"
}