Loading...
Skip to main content
GeekWala

CVE-2024-51745

LOW

Wasmtime doesn't fully sandbox all the Windows device filenames

Published November 5, 2024Updated February 4, 2026Source: osv

Summary

### Impact Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports. ### Patches Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions. ### Workarounds There are no known workarounds for this issue. Affected Windows users are recommended to upgrade. ### References - [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions) of the special device filenames - [ISO-8859-1](https://en.wikipedia.org/wiki/ISO/IEC_8859-1) - [The original PR reporting the issue](https://github.com/bytecodealliance/cap-std/pull/371)

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update wasmtime to 26.0.1 or later
cargo update -p wasmtime --precise 26.0.1
Cargo
Update wasmtime to 24.0.2 or later
cargo update -p wasmtime --precise 24.0.2
Cargo
Update wasmtime to 25.0.3 or later
cargo update -p wasmtime --precise 25.0.3

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

PackageEcosystemAffectedFixed In
wasmtime
crates.io
26.0.026.0.1
wasmtime
crates.io
All versions24.0.2
wasmtime
crates.io
All versions25.0.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2024-51745?
Wasmtime doesn't fully sandbox all the Windows device filenames This vulnerability has been assigned a severity rating of LOW (CVSS score: 5.9/10).
How do I check if my project is affected by CVE-2024-51745?
CVE-2024-51745 affects wasmtime. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-51745 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.9

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-c2f5-jxjv-2hh8
RUSTSEC-2024-0438

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies