SB2026042396 - Improper control of a resource through its lifetime in Wasmtime

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2025-53901)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper state management in the WASIp1 fd_renumber implementation in wasmtime-wasi when processing a crafted sequence of WASI calls. A remote user can call fd_renumber with equal file descriptor values or a previously closed descriptor number and then call path_open to cause a denial of service.

Exploitation requires the ability to open a subsequent file descriptor, which is only possible when a preopened directory was provided to the guest. WASIp2 and embedders using components are not affected.

Remediation

Install update from vendor's website.

References

• https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-fm79-3f68-h2fc
• https://github.com/advisories/GHSA-fm79-3f68-h2fc