Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.9
Wasmtime lets Windows device files with superscript digits be accessed
published 13 days ago
Summary
On Windows, Wasmtime’s file protection stops regular device names like COM1, but it forgets to block names that use superscript numbers (e.g., COM¹). This allows untrusted WebAssembly code that can read any folder to reach printers, modems or other attached devices. Upgrade Wasmtime to version 24.0.2, 25.0.3 or later; there is no other fix.
What to do
- Update wasmtime_jll to version 24.0.2+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | – | wasmtime_jll |
< 24.0.2+0 Fix: upgrade to 24.0.2+0
|
Original advisory text
Wasmtime doesn't fully sandbox all the Windows device filenames
### Impact
Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports.
### Patches
Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions.
### Workarounds
There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.
### References
- [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions) of the special device filenames
- [ISO-8859-1](https://en.wikipedia.org/wiki/ISO/IEC_8859-1)
- [The original PR reporting the issue](https://github.com/bytecodealliance/cap-std/pull/371)
Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", and so on. Untrusted Wasm programs that are given access to any filesystem directory could bypass the sandbox and access devices through those special device filenames with superscript digits, and through them gain access peripheral devices connected to the computer, or network resources mapped to those devices. This can include modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports.
### Patches
Patch releases for Wasmtime have been issued as 24.0.2, 25.0.3, and 26.0.1. Users of Wasmtime 23.0.x and prior are recommended to upgrade to one of these patched versions.
### Workarounds
There are no known workarounds for this issue. Affected Windows users are recommended to upgrade.
### References
- [Microsoft's documentation](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions) of the special device filenames
- [ISO-8859-1](https://en.wikipedia.org/wiki/ISO/IEC_8859-1)
- [The original PR reporting the issue](https://github.com/bytecodealliance/cap-std/pull/371)
References
- https://en.wikipedia.org/wiki/ISO/IEC_8859-1 URL
- https://github.com/advisories/GHSA-c2f5-jxjv-2hh8 URL
- https://github.com/bytecodealliance/cap-std/pull/371 URL
- https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-... URL
- https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conv... URL
- https://nvd.nist.gov/vuln/detail/CVE-2024-51745 URL
- https://rustsec.org/advisories/RUSTSEC-2024-0438.html URL
Severity
7.9
High
CVSS 3.1: 10.0 (OSV)
CVSS 4.0: 7.9 (OSV)
Timeline
Published21 Aug 2026
Updated21 Aug 2026
First seen21 Aug 2026
Sources
JLSEC-2026-1348 · OSV
Monitor software like this
Free during beta