This vulnerability arises from the WASIp1 fd_readdir implementation in Wasmtime copies uninitialized padding into guest memory. When a guest with a preopened directory calls fd_readdir, the system can reveal three bytes of leftover host stack or heap memory for each directory entry. The exposure results in small amounts of kernel or host data becoming visible to the guest, potentially aiding information gathering or further exploitation. It is an information disclosure flaw classified as CWE-908.

Bytecodealliance Wasmtime versions prior to 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 are impacted. These versions are distributed under the designations 36.x, 37.x, and 49.x respectively.

The CVSS score of 2.1 indicates low severity, and no EPSS score is available, suggesting low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as local guest interaction; an attacker would need to control a Wasmtime guest with a preopened directory to trigger the fence. While the data leakage per entry is minimal, correlated entries could reveal larger data sets, but overall risk remains low for typical deployments.